Hims & Hers Says Hackers Stole Customer Support Data Over Several Days in February

Telehealth company Hims & Hers has disclosed that its customer support system was compromised by hackers who exfiltrated customer ticket data over a period of several days in February, TechCrunch reported Thursday. The breach affected a third-party customer support platform used by the company, which sells prescription medications and wellness products including weight-loss drugs and hair-loss treatments online. Hims & Hers said it discovered the intrusion and took steps to contain it, but an undisclosed number of customers had their support ticket information accessed. Customer support systems are a frequent target for threat actors because they aggregate sensitive user data -- names, contact information, account details, and in the case of healthcare-adjacent platforms, potentially health-related queries -- in a single accessible location. Attacks on support infrastructure often occur through credential theft or by exploiting vulnerabilities in the ticketing software itself. Hims & Hers, which went public via SPAC in 2021, has grown rapidly by offering telehealth consultations and direct-to-consumer medications. The company recently expanded its GLP-1 weight-loss drug offerings, attracting a large customer base with significant personal health data. The company said it has notified affected customers and is cooperating with law enforcement. It did not disclose the name of the third-party support vendor or specify exactly how many accounts were affected. Hims & Hers shares traded slightly lower on the news.