Hour-Long Email Phishing Breach Affects PHI of 150,000

A Florida-based technology firm that provides medication therapy management and other services to health plans is notifying nearly 150,000 people that their information was potentially compromised in a phishing attack affecting just one employee’s email account for only about an hour.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

OutcomesOne, which reported the breach to several state regulators last week, discovered the incident on July 1 when an employee noticed “unusual activity” in his work email account and quickly reported it to the company’s security team, the tech firm said.

Outcomes’ security staff promptly secured the compromised email account, and no other email accounts were affected, the company said.

An investigation into the incident found that the affected email account was accessed without authorization for about one hour, Outcomes said. But in that time, the attacker accessed files and emails. Potentially compromised protected health information includes individuals’ names, demographic information, medical provider name, health insurance information and medication information. Social Security numbers were not affected, the company said.

Outcomes in a sample breach notification letter submitted to California’s attorney general says the affected data involved patients’ Aetna Health Insurance plans, for which Outcomes provides medication therapy services.

Outcomes did not mention any other affected health plan clients, telling Oregon’s attorney general that the incident affected 149,094 people.

As of Tuesday, several law firms had issued public statements saying they are investigating the Outcomes breach for potential class action litigation.

Outcomes did not immediately respond to Information Security Media Group’s request for comment and for additional details about the incident.

Persistent Threat

As of Tuesday, the OutcomesOne incident was not yet posted on the U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool website listing health data breaches affecting 500 or more individuals.

But so far in 2025, the HHS’ Office for Civil Rights’ website shows posted 543 major breaches affecting nearly 48.9 million people. Of those, 148 breaches are listed as email incidents affecting a total of more than two million people.

Of the email breaches posted in 2025 so far, 120 of them were reported as hacking/IT incidents, and the rest were reported as unauthorized access/disclosure breaches.

But those numbers don’t necessarily reflect phishing email scams that led to much bigger IT compromises – such a ransomware encryption and data theft.

In fact, research issued last week by security firm SpyCloud found that phishing has overtaken all other vectors as the leading entry point for ransomware across many sectors. SpyCloud found that phishing in 2025 was cited by 35% of organizations affected by ransomware, up from 25% in 2024.

“The rise reflects the growing sophistication of phishing-as-a-service and the use of adversary-in-the-middle techniques to bypass multifactor authentication and hijack active sessions,” SpyCloud said.

But phishing breaches have been a persistent problem for a long time in healthcare.

“Major HIPAA breaches often start small. A phishing email led to the disclosure of PHI for nearly 80 million Anthem customers,” in 2014, said regulatory attorney Paul Hales of the Hales Law Group (see: Anthem Breach: Phishing Attack Cited).

Until the February 2024 ransomware attack on UnitedHealth Group’s IT services unit Change Healthcare that resulted in a PHI compromise affecting 193 million people, the Anthem hack held the infamous distinction of being the largest U.S. health data breach for nearly a decade.

Based on Outcomes’ description of its breach as affecting nearly 150,000 people – despite Outcome’s phished employee reporting the incident quickly – several important lessons emerge for other organizations, some security experts said.

“Any regulated information should be stored and processed with strict access control, periodic access authorization re-approval and with prohibitions on storing on insecure media or within applications,” said Mike Hamilton, field CISO at security firm Lumifi Cyber.

“Ideally, all PHI should be encrypted at best,” he said.

Further, users should be encouraged to report any “unexpected messaging” – especially if it is designed to get the user to take an action – like read a document, he said. Notifying the security team “is one of the best ways to limit the spread and damage by messaging that is designed to recover credentials,” he said.

“Multifactor authentication should also be pervasive and use an authenticator app and not SMS for delivery of the second factor,” he said. “Credentials should be stored in a password vault, and not in browsers to avoid infostealers,” he adds.

Unfortunately, the threats posed by phishing and similar attacks are rising despite attempts to better train employees to be on the lookout for potential phishing, he said.

“The use of generative AI to create convincing phishing messages, combined with target research lets threat actors deliver compelling messaging that is tailored to the individual recipient,” he said.

“There are cognitive biases such as the halo effect, hyperbolic discounting, confirmation bias, curiosity effect, etc., that are used to gain trust, create urgency and successfully convince someone to take an action like authenticating to gain access to a document,” he said. “These refined techniques are quite successful.”

In the meantime, organizations can shrink their attack surface for phishing and other related attacks by about 40% if they prohibit and enforce policies against use of healthcare technology by employees for personal use, he said.

“If all personal use is conducted on personal devices, the opportunities for getting a phishing message through to the user are limited.”