Health technology company Outcomes One hit by phishing attack, reports data breach

Outcomes One Inc., a health technology company, is reporting a data breach that exposed sensitive patient information belonging to nearly 150,000 individuals. 

The breach occurred on July 1, 2025, when an employee's email account was compromised through a phishing attack. The incident was detected relatively quickly when the affected employee noticed suspicious activity in their email account.

Outcomes One launched an investigation working with external cybersecurity experts. The investigation, revealed that the unauthorized actor had gained access to the compromised email account for approximately one hour and accessed files and emails containing highly sensitive information stored within or accessible through the email account.

The incident affected personal and protected health information belonging to 149,094 individuals. The compromised data includes:

• Names
• Addresses
• Medical provider names
• Health insurance information
• Medication information

Outcomes One began notifying affected individuals by mail on September 23, 2025, approximately two and a half months after the investigation concluded.

To support affected individuals, Outcomes One established a dedicated incident response line at 877-332-1681, available Monday through Friday from 9 a.m. to 9 p.m. Eastern Time. This helpline provides affected individuals with the opportunity to ask questions about the incident, understand their potential risk, and receive guidance on protective measures they can take.