Hims & Hers Health, Inc. data breach (2026)

FEDERALSEC 10-K Item 1CFirst filing

Filed Feb 23, 2026bd_0cc210b877a07d46

Hims & Hers Health disclosed a cybersecurity incident in its 10-K filing. In early February 2026, an unauthorized third party gained access to systems via social engineering/phishing of two employees. The actor accessed customer service software, obtaining PII (names, emails, addresses) and potentially treatment category data for customers active between Feb 2025 and Feb 2026. EMRs were not accessed. The investigation is ongoing, and notifications are pending. The company does not believe the incident is materially impactful to financials.

🍁Vermont State AGlinked via same-victim cross-source · 95%

Filed Apr 2, 2026bd_af58dc468106a80b

Hims & Hers, Inc. notified Vermont AG that unauthorized access to its third-party customer service platform occurred Feb 4-7, 2026. Affected data included names and medical information for ~13 Vermont residents. The company secured the platform, notified law enforcement, and offered 12 months of credit monitoring.

Affected (this filing): 13

VT AG >14 bday

⭐Texas State AGlinked via same-victim cross-source · 95%

Filed Apr 6, 2026bd_92ad67154a74fee8

Hims & Hers, Inc. based in San Francisco, California, a business – retail or merchant entity reported a data breach to the Texas Attorney General. The breach was discovered on 2026-03-03 and reported on 2026-04-06. 454 Texas residents were affected. 3,385 individuals affected in total. Types of information involved: Medical Information. Consumers were notified via U.S. Mail.

Affected (this filing): 454

TX AG >30d

Hims & Hers Health, Inc.

Litigation Timing

Timeline