ShinyHunters Claims 8.8TB Breach at Amazon One Medical: Ransomware Claim — What’s Alleged & What To Do

On June 18, 2026, a group calling itself ShinyHunters publicly claimed to have obtained 8.8 terabytes of data from Amazon One Medical, a primary-care network serving more than 830,000 patients. The claim includes patient records, healthcare data, and personally identifiable information. Amazon One Medical has not issued a public confirmation or response to the assertion. The practical stakes center on the sensitivity of the information that may have been taken. Healthcare records often contain details that individuals cannot easily change, and any exposure could affect privacy and future medical or insurance decisions for hundreds of thousands of people.

Inside the incident

The reported claim states that 8.8TB of data was taken from Amazon One Medical’s systems and that the material includes patient records, healthcare data, and PII. The organization operates more than 250 clinics across the United States and serves over 830,000 patients. No independent verification of the volume, contents, or method of acquisition has been made public. One Medical has not confirmed that a breach occurred or disclosed any timeline of events.

How a breach like this happens

Incidents involving large volumes of healthcare data frequently begin with unauthorized access to internal systems. Common pathways include compromised credentials, misconfigured storage environments, or third-party vendor connections that allow data to be copied without immediate detection. Once access is obtained, large datasets can be transferred over time before the activity is noticed. Organizations that maintain extensive electronic health-record platforms face elevated volumes of data that can become attractive targets when such access occurs.

Amazon One Medical and its sector

Amazon One Medical provides primary-care services through a network of clinics and affiliated practices. Organizations in this sector routinely collect and store detailed medical histories, treatment records, insurance information, and contact details for large patient populations. Because these records are both extensive and persistent, any unauthorized disclosure can affect individuals over long periods. The sector’s reliance on interconnected digital systems for scheduling, billing, and clinical documentation increases the quantity of data held in single repositories.

What data was at risk

The claim names patient records, healthcare data, and PII as the material involved. Public information does not specify individual data fields or confirm the exact contents of any files. Healthcare providers of this type typically hold demographic information, medical histories, diagnoses, medications, and insurance details. The precise scope of any exposure in this case remains unconfirmed.

What's at stake

For individuals, exposure of healthcare records and PII can lead to privacy loss, potential misuse in identity-related activity, or complications with insurance and employment. For the organization, an unconfirmed claim of this scale can prompt regulatory review and operational costs associated with investigation and notification. The absence of confirmation leaves both patients and the provider without a verified account of what, if anything, was taken.

Were you affected?

Individuals who are patients of Amazon One Medical or who have received care through its clinics should monitor statements from the organization and review any official notices that may be issued. Practical steps include checking credit reports, placing fraud alerts if warranted, and remaining alert for unusual activity involving medical or insurance accounts. Readers can also run a free exposure scan of their email address against known breach data to see whether their information appears in previously disclosed incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.