Hims & Hers
Disclosed Apr 2, 20265 months ago3,385 affectedConfirmed
Hims & Hers support tickets stolen via Okta SSO and Zendesk compromise
Telehealth firm Hims & Hers told regulators that attackers used a compromised Okta SSO account to access its Zendesk customer service platform from February 4 to 7, 2026, taking names, contact details and support ticket contents. Medical records were not involved.
What is known
| People affected | 3,385 (as reported by the organization) |
|---|---|
| Disclosed | Apr 2, 2026 |
| Discovered | Feb 5, 2026 |
| Happened | Feb 4, 2026 |
| Attack | Phishing |
| Data exposed | Names, Emails, Phone numbers, Messages, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Hims & Hersoag.ca.gov · Official notice | Official notice |
| California AG breach notice: Hims & Hersoag.ca.gov · Regulator | Regulator |
| Hims & Hers warns of data breach after Zendesk support ticket breachbleepingcomputer.com · News | News |
| Texas Attorney General data security breach report BR-0004954: Hims & Hersoag.my.site.com · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Apr 2 | |
| Researchtotal | Apr 3 | |
| Texas AGresidents of TX | Apr 6 | 454 |
History of this record
- 2026-09-25 · data_types: ["names","emails","phone","messages"] to ["names","emails","phone","messages","health"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 3385 · backfill source
- 2026-09-25 · sector: other to health · seed source
- 2026-09-25 · attack: unknown to phishing · seed source
- 2026-09-25 · data_types: [] to ["names","emails","phone","messages"] · seed source
- 2026-09-25 · discovered: empty to 2026-02-05 · seed source
- 2026-09-25 · summary: empty to Telehealth firm Hims & Hers told regulators that attackers used a compromised Okta SSO account to access its Zendesk customer service platform from February 4 to 7, 2026, taking names, contact details and support ticket contents. Medical re · seed source
- 2026-09-25 · title: empty to Hims & Hers support tickets stolen via Okta SSO and Zendesk compromise · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.