PHREESIA, INC.

Phreesia, Inc. filed Item 1C of Form 10-K disclosing its cybersecurity risk management program. The company states it has not identified any cybersecurity incidents that have materially affected its business, results of operations, or financial condition. The filing details governance, third-party risk management, and security controls but reports no specific breach event.

Phreesia, Inc. based in Wilmington, Delaware, a business – retail or merchant entity reported a data breach to the Texas Attorney General. The breach was discovered on 2025-08-25 and reported on 2026-02-06. 1,530 Texas residents were affected. Types of information involved: Name of individual;Social Security Number Information;Medical Information;Health Insurance Information;Date of Birth. Consumers were notified via U.S. Mail.

Phreesia, Inc., a healthcare patient check-in technology company, was impacted by a zero-day vulnerability in third-party software Salesloft Drift, which allowed an unknown threat actor to access Salesforce environments of hundreds of organizations on August 17, 2025. Service tickets containing limited patient information were exposed. 18 Rhode Island residents were identified as affected. Phreesia stopped use of the tool, engaged external cybersecurity experts, and offered two-year Kroll identity monitoring to affected individuals.