PHREESIA, INC.

Phreesia, Inc., a healthcare patient check-in technology company, was impacted by a zero-day vulnerability in third-party software Salesloft Drift, which allowed an unknown threat actor to access Salesforce environments of hundreds of organizations on August 17, 2025. Service tickets containing limited patient information were exposed. 18 Rhode Island residents were identified as affected. Phreesia stopped use of the tool, engaged external cybersecurity experts, and offered two-year Kroll identity monitoring to affected individuals.

Phreesia, Inc. based in Wilmington, Delaware, a business – retail or merchant entity reported a data breach to the Texas Attorney General. The breach was discovered on 2025-08-25 and reported on 2026-02-06. 1,530 Texas residents were affected. Types of information involved: Name of individual;Social Security Number Information;Medical Information;Health Insurance Information;Date of Birth. Consumers were notified via U.S. Mail.

PHREESIA, INC. filed a data-breach notice with the Illinois Attorney General in February 2026 (case 26-02-904). The register records the breach as discovered on August 25, 2025. Personal information types reported: medical information, ssn. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.