One Medical Seniors data breach: archived Iora Health patient files accessed June 8 to 11, 2026

Date	Event
June 8 to 11, 2026	Unauthorized person accesses patient files in the archive's file storage system
June 13, 2026	One Medical learns of the access; secures the system and revokes all access
July 6, 2026	Report to Massachusetts (2026-1085): 5,410 residents
September 30, 2026	Last day to enroll in the Experian monitoring offered in the letter

What happened at One Medical Seniors?

The letter says One Medical learned on June 13, 2026 that an unauthorized person had gained access to a file storage system run by a third party and used to keep archived information for One Medical Seniors. It describes One Medical Seniors as formerly known as Iora Health, which One Medical acquired in 2021. The company says it secured the system immediately and revoked all access.

The letter draws a firm line around the incident. It says the incident is limited to the file storage platform for archived One Medical Seniors data, and does not affect other One Medical clinics or services or the One Medical electronic medical record system. The letter does not name the third party that ran the storage system or say how the unauthorized person got in.

What information was exposed in the One Medical Seniors breach?

The files were clinical records, so they hold more than the usual name and number. The letter says the review found a subset of files from some legacy Iora Health and One Medical Seniors patients, and that what was involved varied by person. It may have included information found in a clinical record, such as treatment plans, diagnostic information, imaging and prescriptions, plus contact details and billing information like a Medicare or Social Security number.

Massachusetts marks two categories for the report, Social Security numbers and medical records, and none of the financial account, driver's license or card categories.

Record	Residents	Data it marks
Massachusetts OCABR, report 2026-1085	5,410	Social Security numbers, medical records

Who received the One Medical Seniors letter?

Patients whose files sat in the Iora Health archive. The letter calls them legacy Iora Health and One Medical Seniors patients, so someone who was treated at an Iora Health practice before it became One Medical Seniors can get this letter under a name they did not know at the time. The guide to breach letters from a company you never dealt with covers that kind of name change and the vendor case, which this incident also is: the files were in a third party's storage system.

What is One Medical offering, and what should patients do?

Two years of Experian IdentityWorks at no cost. The enrollment deadline in the filed copy was September 30, 2026, so the code in the letter no longer works. The letter says identity restoration help is available for 24 months from the date of the letter and needs no action until it is used. Questions go to 833-745-1398, from 7:00 a.m. to 7:00 p.m. in all continental U.S. time zones except major holidays, or in writing to privacy@onemedical.com.

The company also says it rotated credentials for every employee with access to the system and added safeguards it does not describe. For how this offer compares with other letters, see the credit monitoring guide, and for healthcare letters generally, the healthcare provider guide.

How many people were affected?

The letter gives no total, and Massachusetts counts only its own residents: 5,410. No other state record fetched for this entry (California, Vermont) lists the incident. The federal health breach list could not be read when this entry was written, so no national count is given here.

What the documents leave open

• The name of the third party that ran the file storage system, and how the unauthorized person got access.
• The total number of patients notified across all states.
• Whether any of the files were copied out, or only viewed; the letter says the person was able to access them.