{"id":1387,"date":"2026-06-28T11:25:17","date_gmt":"2026-06-28T16:25:17","guid":{"rendered":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/?p=1387"},"modified":"2026-06-28T11:25:17","modified_gmt":"2026-06-28T16:25:17","slug":"ai-voice-cloning-ceo-fraud-las-vegas-cybersecurity","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/blog\/ai-voice-cloning-ceo-fraud-las-vegas-cybersecurity\/","title":{"rendered":"ShinyHunters Steals 8.8 TB from Amazon One Medical Seniors: What Every Healthcare Provider Must Do Right Now"},"content":{"rendered":"
\n

\u26a0 Healthcare Cybersecurity Alert<\/span><\/p>\n

ShinyHunters Steals 8.8 TB from Amazon One Medical Seniors \u2014 What Every Healthcare Provider Must Do Right Now<\/h2>\n

The same threat actor behind the Carnival and Charter breaches just hit a major home health network \u2014 and the vulnerability is one your organization probably shares<\/p>\n

Published by CMIT Solutions \u00b7 Healthcare Cybersecurity \u00b7 5 min read<\/p>\n<\/div>\n

What Happened: ShinyHunters Breaches Amazon One Medical Seniors<\/h2>\n

Between June 8 and June 11, 2026<\/strong>, an unauthorized party gained access to third-party file storage systems owned by One Medical Seniors<\/strong> \u2014 formerly known as Iora Health, and now a subsidiary of Amazon following a $3.9 billion acquisition in 2023. The breach was discovered on June 13 and publicly disclosed on June 24.<\/p>\n

The data extortion group ShinyHunters<\/strong> claimed responsibility, adding One Medical Seniors to its dark web leak site and threatening to release 8.8 terabytes of stolen patient health data<\/strong> unless a ransom was paid by June 22. That deadline has now passed. The stolen files are believed to include demographic and clinical records \u2014 protected health information (PHI) \u2014 belonging to patients at former Iora Health clinics in Atlanta, Denver, Houston, Phoenix, Tucson, Seattle, and locations across Massachusetts and North Carolina.<\/p>\n

What makes this breach especially significant for the broader healthcare cybersecurity landscape is not the size of the company targeted \u2014 it is the type<\/em> of vulnerability that was exploited. The compromised systems were not active production environments. They were legacy archives from an acquisition that changed hands three times in five years<\/strong>, never fully brought under a unified security program. That pattern is everywhere in healthcare \u2014 including in home health agencies, specialty practices, and regional medical groups that have grown through mergers, software migrations, or vendor transitions.<\/p>\n

\n

\u26a0 Breaking: June 2026<\/span><\/p>\n

ShinyHunters breached One Medical Seniors on June 8\u201311, 2026, claiming 8.8 TB of patient PHI including clinical and demographic records. The ransom deadline of June 22 has passed. The same group previously attacked Medtronic, Carnival Corporation, and Charter Communications \u2014 demonstrating a deliberate focus on organizations holding large volumes of sensitive data.<\/em><\/p>\n<\/div>\n

The Inherited Risk Problem That Healthcare Ignores at Its Peril<\/h2>\n

This breach follows a pattern that security experts have been warning about for years. When One Medical acquired Iora Health in 2021, it also inherited Iora\u2019s patient data, vendor relationships, and every HIPAA obligation attached to them. When Amazon acquired One Medical in 2023, those inherited liabilities transferred again. The legacy file storage system that ShinyHunters accessed was sitting in an external third-party environment that had passed through three ownership changes \u2014 and at each handoff, the security review was apparently incomplete.<\/p>\n

HIPAA\u2019s Security Rule is unambiguous: the obligation to protect electronic PHI does not pause or transfer away when organizations change hands.<\/strong> If your home health agency has switched EHR platforms, migrated to a new billing vendor, absorbed a practice, or outsourced any data archiving in the last decade, you may be holding legacy data liabilities you have not fully inventoried \u2014 and ShinyHunters is actively looking for exactly that.<\/p>\n