Hims & Hers, one of the most recognized names in direct-to-consumer telehealth, disclosed on April 2, 2026 that its customer support system was breached in February, and that hackers stole customer support ticket data over several days before the company spotted the intrusion.
The company generates about $1 billion in annual revenue selling prescriptions and treatments for ED, hair loss, weight management (including GLP-1 drugs), mental health, and skincare. The breach hit a platform that holds a lot of sensitive context about what customers are actually purchasing.
How the Attack Happened
The hackers were ShinyHunters, a prolific cybercriminal gang running a broad vishing (voice phishing) campaign across the tech industry in early 2026. The method: impersonate IT support over the phone, convince employees to enter their credentials and MFA codes on a phishing site, then use the resulting access to walk through the front door via Okta SSO.
It worked. Once inside via Okta, attackers accessed Hims & Hers' Zendesk instance — the platform the company uses to manage customer support tickets. The breach window was February 4–7, 2026. The company detected suspicious activity on February 5, locked things down, and wrapped up its investigation on March 3.
ShinyHunters used the same technique against more than 15 companies in February 2026. Other confirmed victims include Crunchyroll (6.8 million users) and ManoMano (38 million customers).
What Data Was Taken
The exposed data includes customer names, email addresses, phone numbers, and physical addresses, plus the contents of their support tickets. For customers who contacted support between mid-February 2025 and February 2026, treatment category information — what they were being treated for — may also have been accessed.
The company is clear that medical records and doctor-patient communications were not accessed. But "treatment category" is a meaningful carve-out for a telehealth company. When your customers are buying ED medication or weight-loss drugs, even knowing that someone was in contact with support about their prescription is sensitive information.
The Response
Hims & Hers is offering all impacted customers 12 months of free credit monitoring and identity restoration services through Cyberscout. The company is advising customers to stay alert for phishing attempts and monitor their accounts for unusual activity.
The breach is a reminder that even well-funded, fast-growing consumer health companies are vulnerable to the oldest trick in the book: a phone call. Okta SSO protects everything — until a well-prepared criminal convinces one employee to hand over the keys.
Comments