One Medical Failed to Protect Patient Medical Records From Cyberattack, Data Breach Lawsuit Claims

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit alleges that One Medical failed to adequately safeguard its patients’ personally identifiable and protected health information from a June 2026 data breach.

Want to stay in the loop on class action lawsuits that matter to you? Sign up for ClassAction.org’s free weekly newsletter.

The 34-page One Medical data breach lawsuit claims that the networks of the Amazon-owned primary care provider were infiltrated by the cybercriminal group ShinyHunters on or around June 13, 2026. According to the complaint, the breach allegedly exposed approximately 8.8 terabytes of sensitive data, including patients’ demographic information and clinical records.

Per the suit, One Medical determined after an internal review that the records of certain patients at One Medical Seniors clinics in Atlanta, Cape Cod, Charlotte, Piedmont Triad, Houston, Phoenix, Tucson, and Seattle were affected.

The case claims that One Medical, as a sophisticated healthcare provider, knew or should have known the importance of protecting the information it collects and stores as part of its business. The filing argues that the company also understood the “foreseeable consequences” patients could face if that information were exposed in a data breach.

The suit alleges that One Medical failed to implement reasonable security measures before the incident, including those recommended by the Federal Trade Commission, and failed to uphold its duty to protect patient data from unauthorized access.

“The specific types of personal data compromised in the Data Breach makes the information particularly valuable to thieves and leaves Plaintiff and other Class Members especially vulnerable to identity theft, tax fraud, medical fraud, credit and bank fraud, and more,” the filing asserts.

The suit stresses that medical information is particularly valuable on illicit marketplaces, such as the dark web, where it can be sold and used to obtain medical treatments, prescription drugs, submit falsified insurance claims and even undergo surgical procedures.

According to the complaint, medical information often has a longer “shelf life” than other forms of personal data because consumers can more feasibly replace compromised payment card numbers in comparison to health and insurance information.

Per the suit, the consequences of One Medical’s failure to safeguard patients' information can be “long-lasting and severe,” as the threat of fraud, identity theft or other misuse of stolen information may continue for years. With any degree of personal information, the complaint claims, cybercriminals can conduct phishing and social-engineering attacks designed to gain victims’ trust and obtain additional data.

The lawsuit also alleges that One Medical has yet to issue any individualized data breach notice to affected patients, effectively leaving them “in the dark” regarding what data was compromised and what steps the company has taken in response to the attack.

The One Medical class action lawsuit looks to represent all individuals in the United States whose private information was compromised in the June 2026 data breach.

Check out ClassAction.org’s lawsuit list for current class action lawsuits.