One Medical, the Amazon-owned primary care provider, is facing proposed class action litigation over a June 2026 data breach that the complaints say exposed the demographic and clinical records of certain legacy patients. At least two proposed class actions have now been filed in federal court in California.
Here is what the company has confirmed, what the lawsuits allege, and what affected patients can do.
What One Medical has confirmed
In a security event notice posted to its website, One Medical said that on June 13, 2026 it learned an unauthorized person had gained access to a third-party file-storage system used to retain archived information for One Medical Seniors — the business formerly known as Iora Health, which One Medical acquired in 2021.
According to the notice, the company determined that between June 8 and June 11, 2026, the unauthorized person was able to access patient files stored in that system, containing demographic and clinical records. One Medical says it secured the system, revoked access, rotated credentials, and launched an investigation.
Importantly, the company states the incident is limited to legacy Iora Health and One Medical Seniors patients — it says patients who were never One Medical Seniors patients are not involved, and that other One Medical clinics and its electronic medical record system were not impacted.
What the lawsuits allege
The complaints allege that One Medical and its parent entity, 1Life Healthcare, Inc., failed to implement reasonable cybersecurity measures to protect patients’ personally identifiable information and protected health information. One complaint alleges the records of One Medical Seniors patients in cities including Atlanta, Charlotte, Denver, Houston, and Phoenix were affected.
The suits also fault the company over notification. One named plaintiff says she received her breach notice on or around June 29, 2026, and the complaints argue affected patients were left “in the dark” about the number of people impacted and exactly what data was taken.
Note: Some figures circulating in early coverage — including a total number of affected individuals and the volume of data exfiltrated — come from law-firm investigations and plaintiffs’ allegations, not from One Medical, which has not publicly confirmed a total. We will update this article as verified figures are released.
What affected patients can do
Because this litigation is at an early stage, there is no settlement, claims process, or money available yet. If you are a legacy Iora Health or One Medical Seniors patient:
- Watch for an official notice. One Medical says it will notify affected patients by mail as it completes its investigation.
- Use the company’s dedicated resources. One Medical opened a toll-free call center for One Medical Seniors and legacy Iora Health patients with questions.
- Stay alert for fraud. Monitor financial and medical statements, and be wary of unexpected messages referencing One Medical or Iora Health.
- Keep any notice you receive. If a claims process is later established, the notice and its dates may matter.