CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Unauthorized access to Hims & Hers Zendesk support tickets by ShinyHunters via compromised Okta SSO

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Unauthorized access to Hims & Hers Health’s Zendesk customer service platform led to the exfiltration of support tickets between February 4 and February 7, 2026, exposing personal information of individuals who interacted with the company’s telehealth services. The incident was attributed to the ShinyHunters extortion gang, which leveraged a compromised Okta SSO account to gain access to Zendesk. No medical records or communications were compromised. The company disclosed the incident on April 3, 2026, and is offering 12 months of free credit monitoring to affected individuals.

Timeline

  1. 03.04.2026 20:41 1 articles · 2h ago

    Zendesk support ticket breach at Hims & Hers Health linked to ShinyHunters via compromised Okta SSO

    Hims & Hers Health disclosed on April 3, 2026, that between February 4–7, 2026, an unauthorized actor accessed support tickets on its Zendesk platform via a compromised Okta SSO account. The incident, attributed to the ShinyHunters extortion gang, exposed personal information but not medical records. The company is offering credit monitoring to impacted individuals and advising heightened vigilance against phishing.

    Show sources
    Open in new tab

Information Snippets

  • Hims & Hers Health discovered suspicious activity in its third-party customer service platform on February 5, 2026, and confirmed unauthorized access to support tickets between February 4 and February 7, 2026.

    First reported: 03.04.2026 20:41
    1 source, 1 article
    Show sources

  • The exposed support tickets contained personal information such as names and contact details but did not include medical records or doctor communications.

    First reported: 03.04.2026 20:41
    1 source, 1 article
    Show sources

  • The ShinyHunters extortion gang was identified as the actor responsible for the breach, which was part of a broader campaign exploiting compromised Okta SSO accounts to access third-party cloud services and SaaS platforms.

    First reported: 03.04.2026 20:41
    1 source, 1 article
    Show sources

  • The threat actors used the compromised Okta SSO account to access Hims & Hers’ Zendesk instance, resulting in the theft of millions of support tickets.

    First reported: 03.04.2026 20:41
    1 source, 1 article
    Show sources

  • Hims & Hers is offering 12 months of free credit monitoring to impacted individuals and advising heightened vigilance against phishing and social-engineering attempts.

    First reported: 03.04.2026 20:41
    1 source, 1 article
    Show sources