Outcomes One Data Breach

The incident was identified on July 1, 2025 when an employee noticed suspicious activity in an email account. The Outcomes security team secured the account and opened an investigation with outside cybersecurity specialists.

Unauthorized access lasted approximately one hour and was limited to a single email account. Certain emails and files were accessed during that period; no other email account was found to be involved.

Outcomes determined on July 17, 2025 that an item that may have been accessed included names and, depending on the person, demographic information, medical-provider names, health-insurance information, or medication information.

The Outcomes notice explicitly says Social Security numbers were not involved. This does not mean every listed data category was present for every affected person.

The HHS healthcare-breach record and an independent breach summary report 257,481 affected individuals. The Texas Attorney General's 256,031 figure reflects a narrower regulator-notification scope; the HHS value is used for the nationwide total.

Health-insurance, medication, and provider details can help an attacker create targeted messages that appear to refer to a genuine health plan or treatment relationship.

An attacker may use a prescription renewal, insurance coverage, or healthcare payment as a pretext to request personal or payment information. Accurate health details in a message do not prove the sender is authorized.

Outcomes secured the affected account, investigated with outside specialists, and said it implemented additional email safeguards and employee phishing training.

The company began notifying data owners on July 25 and mailed individual notices beginning September 23, 2025. A dedicated incident-response line was established for questions.

Notice recipients can review health-plan statements, prescription histories, and medical bills for unfamiliar activity. If they see a service or medication they did not receive, they can contact their health plan directly.

For an unexpected message claiming to come from Outcomes, Aetna, a pharmacy, or a healthcare professional, use the organization's official contact channel before following a link. Do not share a password, payment detail, or verification code.