One Medical Seniors Data Breach
The 2026 One Medical Seniors data breach involved unauthorized access to a third-party file-storage system holding archived legacy Iora Health patient information between June 8 and June 11, 2026.
This classification is based on a reviewed lower bound; the actual impact and severity may be higher.
Exposed Data Types
2 sensitive6- Medical information
- Health insurance information
- Names
- Physical addresses
- Dates of birth
- Social security numbers
About This Breach
Official Texas and Massachusetts records confirm at least 15,451 affected people; the nationwide total has not been disclosed.
One Medical Seniors is the continuing brand of Iora Health, which One Medical acquired in 2021. The company said the incident was limited to archived files belonging to certain legacy Iora Health and One Medical Seniors patients and did not affect other One Medical clinics, services, or its electronic medical record system.
How Did the Incident Occur?
One Medical learned on June 13 that an unauthorized person had accessed the third-party storage system. Its investigation determined that patient files were accessible between June 8 and June 11. The initial access method, service-provider name, and whether files were copied were not disclosed.
What Information Was Affected?
Official sources list names, addresses, dates of birth, Social security numbers, health-insurance information, and demographic and clinical records. The fields may have varied by person, and the company does not say that every category was present for every patient.
How Did One Medical Respond?
The company said it secured the affected system, revoked all access, and rotated credentials for employees who could use the platform. It implemented additional safeguards, began notifying affected patients by mail, and opened a dedicated support line for questions.
What Should Affected Patients Do?
Notice recipients should review health-insurance statements, medical bills, and credit reports for unfamiliar activity. People whose Social security numbers were involved may consider a credit freeze or fraud alert, and unexpected messages using the One Medical name should be verified through a known company channel without following embedded links.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
