Amazon owned OneMedical.com Listed by shinyhunters Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware activity remains a persistent feature of the threat landscape, with groups frequently claiming to have compromised large volumes of data from commercial and healthcare targets. On 18 June 2026 the shinyhunters ransomware group listed Amazon-owned OneMedical.com on its leak site, asserting that it had exfiltrated internal files during a ransomware attack. The listing included a public message stating that over 8.8TB of data had been compromised and setting a deadline of 22 June 2026 for contact before further action.

What happened

The incident was first reported on 18 June 2026 through a listing on the shinyhunters leak site. The group claims to have carried out a ransomware attack against OneMedical.com and states that it exfiltrated internal files amounting to more than 8.8TB. The published message describes the post as a “final warning” and sets 22 June 2026 as the deadline for contact. No independent confirmation of the claimed volume or the precise timeline of the intrusion has been made public. The number of individuals potentially affected remains undisclosed.

Inside shinyhunters

Shinyhunters is a ransomware group that has operated publicly since at least 2020. It typically claims responsibility for intrusions by posting on its own leak site, often accompanied by sample data and ransom demands. The group’s pattern involves exfiltrating large quantities of files before encrypting systems and then using the threat of publication to pressure victims. Its listings have included organisations across multiple sectors; each claim is presented by the group itself and is not automatically verified by third parties.

Amazon owned OneMedical.com and its sector

OneMedical.com operates a membership-based primary-care service and was acquired by Amazon. The company provides in-person and virtual medical consultations and maintains electronic health records for its patients. Healthcare providers routinely store clinical notes, appointment histories, insurance details and administrative correspondence. A claimed compromise at an organisation of this type therefore involves data categories that are subject to regulatory protections in most jurisdictions.

What data was at risk

The facts released to date identify only “internal files exfiltrated in ransomware attack.” No further breakdown of file categories or record counts has been published. Organisations in this sector commonly hold patient identifiers, medical histories and billing information, yet the exact contents of the claimed 8.8TB remain unconfirmed.

Why it matters

Even without a confirmed patient count, the asserted theft of internal files from a healthcare provider raises the possibility that personal health information could be exposed. Such exposure can lead to identity misuse, targeted fraud or reputational harm for affected individuals. For the organisation, the incident adds to the operational and regulatory burden already associated with protecting medical data under existing privacy frameworks.

If your data was in this claimed breach

Individuals who are patients or former patients of OneMedical.com can take the following initial steps while awaiting any official notification from the company:

• Monitor official communications from OneMedical or Amazon for guidance on the incident.
• Review account statements and credit reports for unusual activity.
• Run a free exposure scan of their email address against known breach datasets to check for prior appearances of their information.
• Consider placing a fraud alert or credit freeze if financial details may have been involved.

AICompiled with AI assistance from public sources and published under our editorial standards.