Breachesby GlyphOutcomes One
Disclosed Sep 23, 2025257,481 affectedConfirmed
The business associate (BA), Outcomes One, Inc., reported that an employee was the subject of an email phishing scheme that affected the protected health information (PHI) of 257,481 individuals. The PHI involved included names, dates of birth, medications, and other treatment information. The BA notified HHS, the affected covered entities, the affected individuals, the media, and provided substitute notice. In response to the breach, the BA implemented additional administrative, technical, and security safeguards, and retrained workforce members to better protect PHI.
What is known
| People affected | 257,481 (as reported to HHS) |
|---|---|
| Disclosed | Sep 23, 2025 |
| Discovered | Jul 1, 2025 |
| Happened | Jul 1, 2025 |
| Attack | Phishing |
| Data exposed | HealthInsuranceNames |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
California Attorney General breach notice: Outcomes OneWashington Attorney General breach notice: Outcomes OneOregon DOJ breach notice: Outcomes OneTexas Attorney General data security breach report BR-0004623: Outcomes OneHHS OCR breach report (archive, resolved): Outcomes One (Business Associate, FL)
Notices filed
History of this record
organization to hhsby backfillSource
256031 to 257481by backfillSource
empty to The business associate (BA), Outcomes One, Inc., reported that an employee was the subject of an email phishing scheme that affected the protected health information (PHI) of 257,481 individuals. The PHI involved included names, dates of biby backfillSource
[] to ["health","insurance","names"]by backfillSource
empty to organizationby backfillSource
empty to 256031by backfillSource
other to healthby backfillSource
unknown to phishingby backfillSource
empty to 2025-07-01by backfillSource
2025-10-23 to 2025-09-23by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.