HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedPHIHEALTH_BASICIDENTITY_GOVERNMENTIDENTITY_BASICMediumContained
One Medical Seniors
bd_b4b2a686ebd63462 · schema v1 · pii pii-v1
Full breach record for One Medical Seniors →One Medical Seniors (a subsidiary of 1Life Healthcare) notified Massachusetts residents of a security event involving a third-party file-storage system used for archived One Medical Seniors (formerly Iora Health) patient data. Between June 8-11, 2026, an unauthorized person accessed patient files containing PHI (treatment plans, diagnostics, prescriptions) and PII (contact info, SSN/Medicare numbers). The incident was contained on June 13, 2026, by revoking access and rotating credentials. Affected individuals were offered 24 months of Experian IdentityWorks.
Massachusetts clock✓ MA AG ≤30d18 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-1085-1life-healthcare-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 1, 2026
- Raw hash
- c18ef779cb29d0fd8ee56b99bc362b2bad07d78eb0c5055fbb965c35877f678c
Reporting entity
- Name
- One Medical Seniorsnorm: one medical seniors
Victim entity
- Name
- One Medical Seniorsnorm: one medical seniors
Incident
- Discovered
- Jun 13, 2026
- Materiality determined
- —
- Notification sent
- Jun 29, 2026
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_GOVERNMENTIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 18 days(18 days from discovery to filing)
- Compliance flags
- MA AG ≤30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.