Amazon Bought Clinical Scale at One Medical. It Did Not Buy Clinical Security Maturity.

The ShinyHunters data extortion group has reportedly obtained 8.8 terabytes of data from One Medical, the Amazon-owned primary care provider, and is threatening to release it publicly. If even a fraction of that data contains protected health information, we are looking at one of the largest PHI exposure events in recent memory. Every health system executive, health plan board member, and digital health company leader should be paying attention, not because this is unprecedented, but because it was predictable.

What Is Driving This in Healthcare Specifically

ShinyHunters is not new to healthcare. This group has a documented history of targeting large-scale consumer data repositories and has been linked to breaches affecting hundreds of millions of records across multiple industries. Healthcare's migration toward consumer-facing digital primary care, the Amazon-One Medical model being a flagship example, has created exactly the target profile this group hunts.

The sector is producing a new class of covered entity: consumer health platforms with tech-company DNA, API-first architectures, vast repositories of longitudinal clinical and behavioral data, and developer cultures that move fast. The traditional healthcare security governance model, built around hospital IT perimeters and legacy EHR access controls, was never designed to protect this kind of infrastructure.

The 2024 Verizon Data Breach Investigations Report confirmed that healthcare remains one of the top-targeted sectors for external attacks, with system intrusion and basic web application attacks accounting for the majority of incidents. When you combine that external threat pressure with the structural security gaps created by Big Tech acquisitions of clinical organizations, you have a compounding risk that most boards still do not fully appreciate.

What Organizations Are Getting Wrong

The core problem at the heart of the One Medical situation, and I say this as someone who has sat in the CIO chair and led data integration programs at scale, is that post-acquisition data integration almost always outpaces post-acquisition security governance. Always.

When Amazon acquired One Medical in 2023, the strategic story was about connecting clinical touch points to Amazon's broader consumer health ecosystem. The integration work that follows an acquisition like that is driven by product roadmaps, not risk registers. Engineering teams are incentivized to move data, build connections, and accelerate delivery. Security governance, particularly the healthcare-specific controls required under the HIPAA Security Rule and frameworks like HITRUST CSF, requires a different institutional muscle. Big Tech companies have extraordinary general security capabilities. What they often lack is the healthcare-specific compliance architecture, the PHI data classification rigor, the workforce training culture, and the clinical workflow security discipline that a mature covered entity builds over decades.

I have worked with organizations that passed HITRUST assessments and still suffered significant breaches. The difference between a certification and actual security posture is the quality of implementation and the depth of the culture behind it. A developer culture that treats PHI as just another data type is a vulnerability that no framework assessment will catch on its own.

This is not a critique exclusive to Amazon. It is a structural warning about any Big Tech or private equity acquisition of a healthcare covered entity where the acquirer's security architecture and culture have not been purpose-built for the clinical environment.

Strategic Implications for Healthcare Executives

Let me be direct about what the extortion model ShinyHunters is using changes for your organization.

HIPAA's breach notification requirements were written for a world where the primary concern was unauthorized acquisition of PHI. The 60-day notification clock, the risk assessment process, the safe harbor provisions around encryption, these were designed for exfiltration events where the attacker takes data and disappears. They were not designed for a scenario where 8.8 TB of data hangs over your organization for days or weeks while a criminal group publicly threatens to release it, all before you have completed your forensic investigation.

The reputational and legal exposure in that window is enormous. Patients, regulators, and plaintiffs' attorneys do not wait for your investigation to conclude. The HHS Office for Civil Rights has shown in its enforcement actions, including the $16 million settlement with Anthem following the 2015 breach of nearly 79 million records, that the agency will scrutinize the adequacy of pre-breach safeguards, not just the post-breach response. If your incident response playbook was last updated before public extortion became a standard threat actor tactic, it is out of date.

For health plan and provider board members, the strategic implication is straightforward. Any Big Tech partnership, acquisition, or data-sharing arrangement with a consumer health platform must include rigorous independent security due diligence, not just a review of the vendor's compliance certifications. Certifications tell you what was true at the time of the assessment. Threat actors operate in real time.

What Leaders Should Do

Four things, and I want to be specific about each.

First, update your incident response framework to account for public extortion scenarios. Your legal counsel, communications team, and security leadership need a pre-approved protocol for responding to public ransom threats before they happen. This includes thresholds for law enforcement engagement, pre-drafted patient and member communications, and board notification procedures that do not wait for forensic certainty. CISA's guidance on ransomware and extortion response, combined with HHS's 405(d) HICP voluntary cybersecurity practices, provides a practical foundation.

Second, if you have completed a merger, acquisition, or major health IT vendor integration in the past three years, commission a targeted security integration review. Specifically examine whether the acquired entity's PHI data repositories were fully migrated into your security governance model, including your HITRUST or NIST CSF controls, your data classification schema, your privileged access management controls, and your third-party API security posture. This is not a standard HIPAA risk analysis. It requires someone who understands both the acquirer's architecture and clinical data environments.

Third, treat ShinyHunters' activity as a standing threat to your sector, not an isolated incident. Brief your board. This group has demonstrated the capability and the willingness to target consumer health data at scale. If your organization operates a patient portal, a consumer health app, or any digital front door with a large user base, you are a structurally attractive target. Run a threat modeling exercise against that surface area now.

Fourth, pressure-test your PHI data inventory. The scale of the alleged One Medical exfiltration, 8.8 TB, suggests either a broad access foothold or a poorly segmented data environment. NIST CSF 2.0's Identify function requires organizations to maintain an accurate inventory of assets containing PHI. If you cannot answer, within 24 hours, exactly where your highest-sensitivity PHI repositories live and who has access to them, that is the gap a threat actor will exploit before you do.

The Warning Every Healthcare Leader Needs to Hear

The organizations that survive incidents like this are not the ones with the most certifications. They are the ones whose leadership treated security as an operational discipline rather than a compliance deliverable. The One Medical situation is a signal. ShinyHunters is not hunting compliance gaps. They are hunting for structural vulnerabilities in organizations that scaled faster than their security governance could keep pace with.

Healthcare is full of those organizations right now. If yours is one of them, the time to close those gaps is before your name appears in a HIPAA Journal headline.

At MTC Group, we work with health plans, providers, and health IT companies to build security programs that can withstand real-world threat actors, not just auditors. If you are re-examining your incident response posture, your acquisition security integration, or your overall cybersecurity governance framework, I would welcome the opportunity to discuss.

---

Sources & Further Reading

1. ShinyHunters Threatens to Leak 8.8 TB of Stolen One Medical Data, HIPAA Journal

2. HHS OCR Breach Portal, U.S. Department of Health & Human Services, Office for Civil Rights

3. HIPAA Security Rule, HHS Office for Civil Rights

4. 2024 Data Breach Investigations Report, Verizon

5. Health Industry Cybersecurity Practices (HICP): Managing Threats and Protecting Patients, HHS 405(d) Task Group

6. NIST Cybersecurity Framework 2.0, National Institute of Standards and Technology