Almeida Law Group is investigating a data breach at One Medical Group, Inc. If you were affected, contact Almeida Law Group.
About One Medical Group, Inc.
One Medical Group, Inc., operated by 1Life Healthcare, Inc., is an Amazon-owned, membership-based primary care organization offering in-person, digital, and virtual care services. Headquartered in San Francisco, California, the company was acquired by Amazon in February 2023 for approximately $3.9 billion. In 2021, One Medical acquired Iora Health, a Medicare-focused primary care practice, which it rebranded as One Medical Seniors. The breach specifically affected a legacy archive containing data from Iora Health and One Medical Seniors patients, making the nature of the information involved — which includes health records, Social Security numbers, and Medicare details — particularly sensitive.
What Happened?
One Medical Group, Inc. was listed in an HHS Office for Civil Rights breach portal report submitted on July 17th, 2026, identifying a hacking and IT incident affecting 153,174 individuals. The breached information was located on a network server, and no business associate was identified as involved.
According to One Medical and reporting by HIPAA Journal and other sources, an unauthorized party gained access to a third-party file storage system between June 8th, 2026 and June 11th, 2026. One Medical discovered the intrusion on June 13th, 2026. The breach was limited to a legacy archive of data from Iora Health and One Medical Seniors patients across nine U.S. markets: Atlanta, Cape Cod, Charlotte, Piedmont Triad, Denver, Houston, Phoenix, Tucson, and Seattle. One Medical’s primary electronic medical record system and other clinics were not affected. The company began notifying affected individuals by U.S. mail on June 29th, 2026. Compromised data varies by individual but may include names, addresses, dates of birth, contact information, Social Security numbers, medical records, treatment plans, diagnostic information, imaging and prescription data, Medicare numbers, health insurance details, and billing-related information.
On June 17th, 2026, the threat actor group ShinyHunters posted a claim on its dark web leak site alleging responsibility for the breach and claiming to have exfiltrated 8.8 TB of data, with a ransom deadline of June 22nd, 2026. One Medical has confirmed the unauthorized access but has not confirmed ShinyHunters’ claimed data volume or attribution. A putative class action was filed on July 11th, 2026 in San Francisco by lead plaintiff Donna Sanders, alleging One Medical failed to implement reasonable data security practices. Law firms including Federman & Sherwood and Schubert Jonckheer & Kolbe LLP have also announced investigations on behalf of affected individuals.
Key Facts at a Glance
- Company or Organization: One Medical Group, Inc. (operated by 1Life Healthcare, Inc.)
- Industry: Healthcare — primary care provider (membership-based, technology-powered)
- Location: San Francisco, California
- Incident type: Hacking/IT Incident — unauthorized access to network server
- Date of breach: June 8th, 2026 – June 11th, 2026
- Date breach discovered: June 13th, 2026
- Date of consumer notification: June 29th, 2026
- Total persons affected: 153,174
- Identity theft protection offered: 24 months of Experian IdentityWorks Credit 3B monitoring
- Litigation status: Putative class action filed July 11th, 2026 (Donna Sanders v. One Medical Group, Inc., San Francisco); law firm investigations announced by Federman & Sherwood and Schubert Jonckheer & Kolbe LLP
- Source: HHS Office for Civil Rights breach portal report; HIPAA Journal; ClassAction.org; Courthouse News Service
What Should You Do?
If you received a notice from One Medical Group, Inc., you should enroll in the 24-month Experian IdentityWorks Credit 3B monitoring offered — check your notice for the enrollment deadline and instructions. Whether or not you enroll in that program, consider placing a fraud alert or credit freeze with each of the three major credit bureaus (Equifax, Experian, and TransUnion) to help prevent new accounts from being opened in your name. Review your credit reports at AnnualCreditReport.com for any unfamiliar accounts or activity. Because health and medical information was involved in this breach, also review your Explanation of Benefits statements from your insurance provider and request copies of your medical records to check for any services you did not receive. If you discover signs of fraud or identity theft, report them at IdentityTheft.gov for step-by-step recovery guidance.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
