ShinyHunters Steals 8.8 TB from Amazon One Medical Seniors: What Every Healthcare Provider Must Do Right Now

What Happened: ShinyHunters Breaches Amazon One Medical Seniors

Between June 8 and June 11, 2026, an unauthorized party gained access to third-party file storage systems owned by One Medical Seniors — formerly known as Iora Health, and now a subsidiary of Amazon following a $3.9 billion acquisition in 2023. The breach was discovered on June 13 and publicly disclosed on June 24.

The data extortion group ShinyHunters claimed responsibility, adding One Medical Seniors to its dark web leak site and threatening to release 8.8 terabytes of stolen patient health data unless a ransom was paid by June 22. That deadline has now passed. The stolen files are believed to include demographic and clinical records — protected health information (PHI) — belonging to patients at former Iora Health clinics in Atlanta, Denver, Houston, Phoenix, Tucson, Seattle, and locations across Massachusetts and North Carolina.

What makes this breach especially significant for the broader healthcare cybersecurity landscape is not the size of the company targeted — it is the type of vulnerability that was exploited. The compromised systems were not active production environments. They were legacy archives from an acquisition that changed hands three times in five years, never fully brought under a unified security program. That pattern is everywhere in healthcare — including in home health agencies, specialty practices, and regional medical groups that have grown through mergers, software migrations, or vendor transitions.

The Inherited Risk Problem That Healthcare Ignores at Its Peril

This breach follows a pattern that security experts have been warning about for years. When One Medical acquired Iora Health in 2021, it also inherited Iora’s patient data, vendor relationships, and every HIPAA obligation attached to them. When Amazon acquired One Medical in 2023, those inherited liabilities transferred again. The legacy file storage system that ShinyHunters accessed was sitting in an external third-party environment that had passed through three ownership changes — and at each handoff, the security review was apparently incomplete.

HIPAA’s Security Rule is unambiguous: the obligation to protect electronic PHI does not pause or transfer away when organizations change hands. If your home health agency has switched EHR platforms, migrated to a new billing vendor, absorbed a practice, or outsourced any data archiving in the last decade, you may be holding legacy data liabilities you have not fully inventoried — and ShinyHunters is actively looking for exactly that.

• How ShinyHunters operates: The group identifies organizations holding large volumes of sensitive data, compromises third-party file storage or vendor systems — not always the primary EHR — and exfiltrates quietly before triggering a ransom demand on a tight deadline.
• Why legacy systems are the entry point: Archived systems often lack the MFA, encryption, and network segmentation that production systems have. They are low-visibility, rarely audited, and frequently forgotten after a platform migration or acquisition.
• What escalation looks like: ShinyHunters has a documented history of escalating beyond data threats — including DDoS attacks on victim websites and coordinated email flooding — when organizations resist. Once the ransom deadline passes, the group’s leverage shifts to reputational and operational destruction.
• The HIPAA breach notification clock: Under HIPAA, covered entities have 60 days from discovery to notify affected individuals. For One Medical, that clock started June 13. For any organization that experiences a breach today, the same 60-day window begins immediately — and OCR is watching.

What This Means for Home Health Agencies and Small Medical Practices

You do not need to be Amazon’s size to face this risk. Home health agencies, hospice providers, specialty clinics, and small medical practices frequently operate with fragmented data environments: an older EHR that was never fully decommissioned, a billing vendor who holds archived claim data, a file-sharing system left over from a previous software vendor. Each of those represents exactly the kind of surface area ShinyHunters — and groups like them — actively probe.

• ⚠ HIPAA fines for unsecured PHI can reach $1.9 million per violation category — and “I didn’t know that system still held patient data” is not a defense
• ⚠ Third-party vendors who archive your data are your Business Associates under HIPAA — their breach is legally your breach
• ⚠ Patient trust is the core asset of any home health or primary care practice — a public data leak can devastate referral networks overnight
• ⚠ Extortion groups increasingly target mid-size healthcare organizations knowing they lack the legal and PR resources of a large hospital system to manage fallout
• ⚠ The OCR breach portal wall of shame lists organizations of every size — no home health agency or small practice is below the radar of federal regulators

Three Steps Healthcare Providers Must Take Now

Healthcare Cybersecurity You Can Count On — CMIT Solutions

CMIT Solutions works with home health agencies, medical practices, and healthcare-adjacent businesses to identify exactly the kind of hidden legacy risk that brought down One Medical Seniors. From HIPAA risk assessments and Business Associate Agreement audits to managed security monitoring and vendor security reviews, we help small and mid-size healthcare organizations close the gaps that extortion groups like ShinyHunters actively hunt for.

The One Medical breach is a warning, not an anomaly. Extortion groups are systematically targeting healthcare because the data is valuable, the regulatory stakes are high, and the legacy infrastructure problem is widespread. Do not wait to find your forgotten archive on a dark web leak site.