One Medical data breach

What we know

One Medical operates as a prominent membership-based primary care practice, seamlessly integrating modern technology with traditional doctor's office visits to deliver accessible outpatient healthcare services across the United States. Because of its unique hybrid digital and in-person model, the organization collects and maintains vast repositories of highly sensitive patient records through its proprietary mobile application and web portals. This ecosystem necessitates the aggregation of extensive medical histories, detailed clinical notes, diagnostic test results, insurance policies, and private identification credentials for hundreds of thousands of patients seeking continuous wellness care, chronic disease management, and urgent virtual consultations. In 2026, official filings submitted to the New Hampshire Attorney General revealed that One Medical experienced a cybersecurity incident that compromised the integrity and confidentiality of its digital infrastructure. While healthcare data breaches frequently stem from sophisticated ransomware deployments, credential harvesting attacks, or vulnerabilities within third-party health tech vendor ecosystems, incidents of this nature typically indicate that unauthorized external actors successfully penetrated network perimeters or exploited software vulnerabilities. Such breaches expose the structural weaknesses inherent in managing large-scale medical databases, leaving patients vulnerable to the exposure of confidential health interactions. The exposure resulting from a healthcare sector data breach involves a uniquely damaging convergence of personal identifying information and protected health information, encompassing names, dates of birth, Social Security numbers, health insurance policy IDs, medical record numbers, and specific clinical diagnosis or treatment details. When this sensitive data is compromised, victims face severe, long-term risks that extend far beyond standard financial fraud. Medical identity theft can lead to fraudulent claims being billed under a patient's insurance, inaccurate medical records being commingled with their actual health history, and compromised diagnostic histories that directly threaten future medical care and treatment accuracy. As a covered entity operating within the healthcare sector, One Medical is bound by stringent federal and state mandates, most notably the Health Insurance Portability and Accountability Act (HIPAA) Security and Privacy Rules, alongside state-level consumer protection statutes. These legal frameworks require healthcare providers to implement robust administrative, physical, and technical safeguards, including comprehensive data encryption, multi-factor authentication, regular vulnerability assessments, and strict access controls. A successful data breach of this magnitude serves as a strong indicator that the organization may have failed to uphold these mandatory security standards, potentially breaching its fiduciary and statutory duty to safeguard patient confidentiality. Receiving a formal data breach notification letter from One Medical serves as official legal acknowledgment that your confidential records were compromised due to corporate security failures. Under modern jurisprudence, the receipt of such a notification establishes the legal standing necessary to participate in a class action lawsuit against the responsible entity, without requiring immediate proof of out-of-pocket financial loss or fraudulent activity. Our firm handles these complex data privacy claims on a strict contingency fee basis, meaning affected individuals pay zero upfront costs and owe attorney fees only if we successfully recover financial compensation on their behalf.

See every breach reported in New Hampshire or read what to do after a ransomware attack.