Is Your Health Data Safe? Hims & Hers Breach Exposes 9 Million Users in 2026

When you share your most intimate health details with a telehealth app, you assume someone’s protecting them. That assumption just got a lot harder to justify.

Hims & Hers, the billion-dollar telehealth darling that’s reshaped how Americans access everything from hair loss treatments to mental health care, disclosed a breach affecting “customer support ticket data” over several days in February. Nine million users. Let that number sink in.

What Actually Happened

According to TechCrunch, hackers accessed the company’s customer support systems — not the core medical records, but the ticket data that contains your messages, perhaps your prescriptions, definitely your identity. The company says it’s “notifying affected users,” but if you’re one of them, you’re probably still in the dark about what exactly was taken.

Here’s the uncomfortable truth: this wasn’t a sophisticated nation-state attack. It was a compromise of customer support infrastructure — the kind of system companies treat as secondary while pouring resources into their shiny patient-facing apps.

Why This Matters More Than Your Average Data Breach

Here’s where I diverge from the standard cybersecurity analysis. Yes, credit card theft is bad. But health data? That’s the gift that keeps on giving to identity thieves. Your medical history, your prescriptions, your mental health struggles — this isn’t data you can cancel like a credit card. It follows you forever.

And Hims & Hers isn’t some scrappy startup. They spent over $1 billion on marketing in 2025 alone. They have partnerships with major insurers. They’re publicly traded. If they can’t secure customer support tickets, what does that say about the smaller telehealth players?

What You Can Do TODAY

1. Assume your data’s already compromised. It probably is, from some breach you never heard about. Freeze your credit with all three bureaus — it’s free and takes 15 minutes.

2. Use a password manager. If you reused your Hims password anywhere else (you know you did), change it now. I recommend Bitwarden or 1Password.

3. Enable two-factor authentication on every health app you use. Yes, it’s annoying. But less annoying than someone hijacking your prescription.

4. Read the terms of service. I know, nobody does. But somewhere in there’s what happens when things go wrong. Most telehealth companies limit liability to “the maximum extent permitted by law” — which is essentially nothing.

Telehealth customer support data breach visualization — Customer support systems often contain more sensitive data than patients realize

The telehealth industry exploded from $15 billion in 2020 to an estimated $120 billion by 2026. But security spending hasn’t kept pace. This breach is a warning shot.

Will you wait until your medical records show up on the dark web, or act now?

Healthcare data privacy protection measures — Protecting your health data requires proactive steps, not just trust in companies

If you’re invested in crypto or fintech, pay attention: regulators are watching. The FTC has already signaled increased scrutiny of health data handling. Companies that treat cybersecurity as an afterthought will face real consequences.

This isn’t about fear. It’s about recognition. The convenience revolution in healthcare came with hidden costs we’re only beginning to understand.

Related Articles:

Sources: TechCrunch | BBC News