Hims & Hers customer support system breached

Hims & Hers, a well-known telemedicine company that offers weight loss medications and sexual health prescriptions, recently confirmed a major data breach that affected its third-party customer service platform . The incident, according to a notice filed with the California attorney general’s office, occurred between February 4 and 7, when hackers broke into the ticketing system and extracted support tickets containing users’ personal information.

Hims & Hers: What information was affected?

The company said the hackers primarily obtained customer names and contact information, along with other personal data not detailed in the statement. While users’ medical records did not appear to have been affected, support systems often include sensitive information about customers’ accounts and health status. The exact number of users whose information was exposed has not yet been determined, but California law requires notification of breaches involving 500 or more residents of the state.

See also: CERT-EU: European Commission hack affected dozens of EU entities

Hims & Hers spokesperson Jake Martintold TechCrunch that the breach was the result of attack social engineering, in which hackers tricked employees into granting them access to the company’s systems. According to Martin, the stolen data primarily included names and email addresses, without specifying what other types of information were taken.

Customer support system: New target for hackers

In recent years, support and ticketing systems have become a popular target for financially motivated hackers. Attacks on such platforms allow attackers to gain access to customer data and then demand ransom. An example is the recent breach of Discord, where hackers broke into the support system and exposed the government IDs of approximately 70,000 people, including driver's licenses and passports.

This highlights the vulnerability of third-party support platforms, as many companies rely on them to handle customer requests. Social engineering attacks and exploitation of weaknesses in these systems can have serious consequences for privacy.

See also: Drift social engineering: Hackers stole $285 million.

Protection strategies and future steps

Hims & Hers has not said whether it has received any communication from the hackers, such as a ransom demand, but the company is urging users to closely monitor their accounts for suspicious activity. This case highlights the need to strengthen security across all departments of companies, especially those that handle personal customer data.

Security experts recommend strengthening employee training to recognize social engineering attempts and adopting multiple layers of protection, such as multi-factor authentication and regular access reviews. In addition, companies are urged to regularly review the third-party services they use, ensuring that providers meet security and compliance standards.

See also: Granola: Notes Leak – Change Privacy Settings

Telemedicine and data vulnerability

This breach highlights an important issue: as telemedicine expands, the systems that support healthcare services are becoming increasingly attractive targets for attacks. Personal health information and communication data have high value on the illicit market and can be used for further fraud or identity theft.

Hims & Hers now faces the challenge of restoring customer trust and strengthening security systems to prevent future breaches. At the same time, this case serves as a warning to the entire telemedicine industry, highlighting the need for proactive data security measures and constant monitoring of digital infrastructure.