Amazon-owned primary care provider One Medical has confirmed that an unauthorized party accessed a third-party file storage system holding archived patient records from its One Medical Seniors business, formerly Iora Health. The company says the intrusion window ran from June 8 to June 11, 2026, and was discovered on June 13, with public disclosure via a website notice on June 17. One day later, the extortion group ShinyHunters listed One Medical on its dark web leak site and claimed 8.8 terabytes of stolen data, attaching a June 22 deadline to open negotiations. One Medical has not acknowledged or validated the ShinyHunters claim, and as of reporting no proof pack had been published. The number of affected individuals has not been disclosed by the company or estimated by any source reviewed here.
What Happened
The confirmed facts come from One Medical's own breach notice, relayed consistently across heise online (S2), TechTarget (S3), HIPAA Journal (S4), Healthcare IT News (S5), The HIPAA Guide (S6) and MedRisk (S8). An unauthorized third party gained access to a third-party file storage platform used to retain archived Iora Health and One Medical Seniors records. One Medical detected the activity on June 13, 2026, immediately deactivated the legacy system, revoked all user access, and began rotating credentials for employees who had access to it.
The company states the compromise was confined to that storage platform. Per its notice, no other One Medical clinics, virtual care services, the One Medical electronic medical record system, or other Amazon systems were affected.
The extortion pressure arrived separately. TechTarget and The HIPAA Guide both place the ShinyHunters leak-site post on June 18, 2026, one day after One Medical's disclosure. Both quote the same message verbatim: "This is a final warning to reach out by 22 June 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline." No ransom figure was stated in the post.
Accounts do differ on two points. On timing, most sources converge on the June 18 listing, while Tech Insider (S1) describes the leak-site addition as occurring in "mid-June 2026." Given that S1 is the lowest-confidence source in this set and its text contains visible internal inconsistencies, the June 18 date supported by multiple independent outlets is the stronger reading. On attack class, TMC Insight (S7) characterises the event as a "ransomware intrusion," while every other source describes pure data theft and extortion with no encryption stage. The HIPAA Guide is explicit that ShinyHunters "solely engages in data theft and extortion." The ransomware framing appears to be an outlier and should not be treated as confirmed.
What Was Taken
One Medical has confirmed the affected storage environment contained demographic information and clinical records belonging to legacy Iora Health and One Medical Seniors patients. The specific data categories exposed have not been made public, and neither has the total number of individuals involved.
Affected clinic geographies are described slightly differently across sources. heise online, HIPAA Journal and MedRisk each list nine locations: Atlanta, Cape Cod, Charlotte, Denver, Houston, Phoenix, Seattle, Tucson and the Piedmont Triad region. Healthcare IT News gives a partially overlapping list, naming Atlanta, Denver, Houston, Phoenix, Tucson and Seattle plus clinics "in Massachusetts and North Carolina," which is a state-level restatement of Cape Cod, Charlotte and Piedmont Triad rather than a genuine contradiction. Tech Insider references "nine clinic locations" but omits Piedmont Triad from its enumeration, listing only eight.
On volume, the 8.8TB figure is uniform across all eight sources, but it originates entirely with the attacker. TMC Insight notes that One Medical "has not validated this claim and the group has yet to release proof." MedRisk reports that neither One Medical nor independent researchers have corroborated it. Healthcare IT News goes further and describes ShinyHunters as only "rumored to have claimed the attack." Defenders should treat 8.8TB as an unverified extortion claim, not a measured exfiltration total. Leak-site volume claims are routinely inflated, and archive-heavy storage buckets can produce large raw byte counts from comparatively few patient records.
Why It Matters
This is an acquisition-inheritance breach, and that is the transferable lesson. One Medical acquired Iora Health in 2021, in what Clearwater president Baxter Lee described to Healthcare IT News as a $2.1 billion deal completed in September 2021. Amazon then acquired One Medical for $3.9 billion in 2023. Each transaction moved patient data, vendor relationships and HIPAA obligations onto a new balance sheet without necessarily moving them into the acquirer's current security architecture. Lee's framing is direct: One Medical "inherited Iora's patient data, its vendor relationships, and every HIPAA obligation attached to them," and the compromised system "was not a current production environment."
For a covered entity, dormant does not mean out of scope. HIPAA obligations attach to archived protected health information exactly as they do to live records, and an extortion group does not care whether a dataset is in production. TMC Insight cites HHS Office for Civil Rights data showing hacking and IT incidents accounted for more than 79% of large HIPAA-reported breaches in 2023, with a meaningful share involving business associates and outdated systems, and a 2024 Gartner projection that more than 60% of healthcare delivery organizations will rely on third-party cloud or storage providers for clinical archiving by 2027. The exposure surface being described here is growing, not shrinking.
There is also a target-selection signal. The HIPAA Guide notes ShinyHunters is a big-game hunter that has recently hit medical device manufacturer Medtronic and dental benefits administrator DentaQuest. Tech Insider reports that within roughly two weeks of the One Medical listing, the group also added the National Association of Insurance Commissioners, a firm identified as ICSecurity, and the Council of Europe to its site. That reporting is single-source and lower-tier, and Tech Insider's own account of those cases is internally muddled, so treat the wider campaign framing as unconfirmed. The healthcare focus, however, is corroborated independently.
The Attack Technique
No source establishes the specific initial access vector for the One Medical intrusion. What is available is actor tradecraft, and two sources describe it consistently.
TechTarget reports that ShinyHunters typically uses sophisticated voice phishing and victim-branded credential harvesting sites to reach corporate environments. The HIPAA Guide adds that the group specialises in abusing compromised credentials, OAuth token theft and vishing for initial access, then moves quickly to identify and exfiltrate sensitive data in high volume, frequently without detection.
That profile maps cleanly onto the observed facts even without attacker-side confirmation. The intrusion targeted a third-party file storage platform, not the production EMR. One Medical's remediation included revoking all user access and rotating credentials for every employee with access to that system, which is the response pattern you see when identity is the suspected entry point rather than an exploited software flaw. The three-day access window from June 8 to June 11 is also consistent with a smash-and-grab exfiltration run rather than prolonged network dwell. None of this is proof of vector, and no vulnerability identifier has been associated with this incident.
What Organizations Should Do
-
Inventory inherited data estates from every acquisition. Enumerate storage systems, vendor contracts and data repositories that arrived through M&A rather than through your own procurement. Anything you cannot name, you cannot defend, and archived PHI remains fully in scope under HIPAA.
-
Treat legacy archives as production for security purposes. Apply current logging, MFA, network segmentation and access review standards to dormant storage. If a system is too old to instrument properly, that is a case for migration or destruction, not for exemption.
-
Harden identity against vishing and OAuth abuse specifically. Given ShinyHunters' documented reliance on voice phishing, victim-branded credential harvesting pages and token theft, prioritise phishing-resistant MFA, strict help-desk identity verification for password and MFA resets, and inventory plus review of third-party OAuth grants.
-
Instrument for bulk egress, not just intrusion. The three-day window here would defeat any detection strategy that depends on catching lateral movement over weeks. Alert on anomalous read volume and outbound data transfer from archive and object storage, with thresholds set low enough that a single large sync is visible.
-
Extend third-party risk review to storage and archiving vendors. File storage providers holding clinical records are business associates carrying your regulatory liability. Require breach notification terms, credential hygiene evidence and log access.
-
Pre-build the credential rotation and access revocation playbook. One Medical's ability to deactivate the system, revoke all access and rotate credentials within days of discovery limited the incident's blast radius. Rehearse that sequence before you need it, including for systems no team actively owns.
-
Do not treat leak-site volume claims as findings. Run your own scoping. The 8.8TB figure has not been substantiated by any independent party, and building notification or public messaging on an attacker's arithmetic is a reputational and regulatory hazard.
Sources: One Medical Breach: ShinyHunters Claim 8.8TB Stolen 2026 | One Medical: After cyberattack on Amazon's health service, data lea... | ShinyHunters threatens to leak One Medical Seniors patient data Te... | ShinyHunters Data Extortion Group Threatens to Leak 8.8 ... | One Medical-owned legacy systems breached in cyberattack | ShinyHunters Claims Responsibility for Amazon One Medical Seniors D... | One Medical Reports Ransomware Breach Involving Legacy Patient Data... | ShinyHunters Threatens One Medical With Massive Data Leak Following...