HackingHealthcareHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedData ExfiltratedHealth (basic)Identity (basic)Government IDPHIHighContained

One Medical Seniors

bd_b4b2a686ebd63462 · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 13, 2026

Filed

Jul 6, 2026

To disclose

23 days

Affected

5,410state residents only

Confidence

66%

Full breach record for One Medical Seniors →

One Medical Seniors (a subsidiary of 1Life Healthcare) notified Massachusetts residents of a security event involving a third-party file-storage system used for archived One Medical Seniors (formerly Iora Health) patient data. Between June 8-11, 2026, an unauthorized person accessed patient files containing PHI (treatment plans, diagnostics, prescriptions) and PII (contact info, SSN/Medicare numbers). The incident was contained on June 13, 2026, by revoking access and rotating credentials. Affected individuals were offered 24 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Massachusetts clock✓ MA AG ≤30d23 days discovery → filing

Incident timeline

undetected · 5 days

discovery → filing · 23 days

Jun 8, 2026

Begins

Jun 13, 2026

Discovered

Jul 6, 2026

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed5,410 affectedView incident

Name: One Medical Seniors
norm: one medical seniors

Name: One Medical Seniors
norm: one medical seniors
Industry: Healthcarellm

Discovered: Jun 13, 2026
Breach occurred: Jun 8, 2026 – Jun 11, 2026
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 29, 2026
Affected individuals: 5,410state-resident count only
Data types: Health (basic)Identity (basic)Government IDPHI
Data elements: Social Security numberMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Secured the affected system and revoked all access
Launched an investigation
Revoked all user access
Rotated credentials for all employees with access to the system
Implemented additional safeguards
Changes made: Implemented additional safeguards to help prevent something like this from happening in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 23 days(23 days from discovery to filing)
Compliance flags: MA AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1085-1life-healthcare-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 6, 2026
Raw hash: c18ef779cb29d0fd8ee56b99bc362b2bad07d78eb0c5055fbb965c35877f678c

Reporting entityOne Medical Seniors

Victim entityOne Medical Seniors

Incidentdiscovered Jun 13, 2026

Stated responseSecured the affected system and revoked all access

ComplianceMA AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov