Phreesia Data Breach

On or about August 25, 2025, Phreesia, Inc. (“Phreesia”) became aware of a data security incident impacting a third‑party software tool used with its Salesforce environment. According to the notice, an unknown actor exploited a previously unknown vulnerability in a vendor tool (Salesloft Drift), enabling access to certain service tickets stored in Salesforce. Phreesia reports it took immediate steps to contain and remediate the incident.

Upon learning of the issue, Phreesia secured its Salesforce environment (including disabling the affected tool), launched an internal investigation with external cybersecurity experts, and notified appropriate authorities and stakeholders.

The forensic investigation determined that, on August 17, 2025, the unauthorized party accessed certain customer service tickets in Salesforce. These tickets occasionally contained limited patient information shared by healthcare organizations to resolve support issues. Following a review of the impacted data, Phreesia concluded that certain individuals’ personal information may have been involved.

After completing its review, Phreesia began notifying impacted individuals. According to the notice, Phreesia stated that it has no evidence of attempted or actual misuse of the information at this time and that medical charts and payment card or financial account information were not accessed.

Phreesia is a healthcare technology company that helps organizations automate patient check‑in and related administrative workflows.

The breach occurred within a third‑party vendor integration connected to Phreesia’s Salesforce environment and involved unauthorized access to certain internal support tickets.

Following the incident, Phreesia reported that it has stopped using the affected software, implemented additional security measures, and is reviewing third‑party risk management practices to reduce the risk of future incidents. Phreesia is offering affected individuals complimentary, two‑year identity and credit monitoring services through Kroll, including monitoring, fraud consultation, and identity restoration support.

If you received a Notice of Data Breach letter from Phreesia, it confirms that your personal information may have been involved in this security incident.

What information is involved in the Flickr Data Breach?

Compromised information may include:

Your Personally Identifiable Information (PII) includes data that can be used to identify you. Companies that handle sensitive personal data are legally required to safeguard this information. When PII is exposed in a data breach, it may be used by cybercriminals to commit identity theft, financial fraud, phishing, or other unauthorized activity.

A specific subset of PII is Protected Health Information (PHI), which includes medical and health insurance data protected under federal and state privacy laws (including HIPAA and related state statutes). Phreesia reports that medical charts were not accessed, and the incident was limited to service tickets in Salesforce; however, any health‑related details included in those tickets could potentially be considered PHI. When PHI is exposed, it can be combined with other personal data to facilitate identity, medical, or insurance fraud.

The exposure of identifying and contact information can increase the risk of phishing, account takeover, and other misuse, even if fraudulent activity has not yet been detected.

Residents of California benefit from enhanced privacy protections under the California Consumer Privacy Act (CCPA), which grants additional rights related to the collection, storage, and protection of personal information. California residents may also have additional legal remedies depending on the nature of the compromised data.

If your information was involved in this data breach, carefully monitor your email and online accounts, review statements and credit reports for suspicious activity, and follow the enrollment instructions in Phreesia’s notification letter to activate your complimentary Kroll identity monitoring within the stated deadline.

If you received a Notice of Data Breach related to the Phreesia incident, your personal information may be at risk.

Contact the Data Breach Lawyers at Emery | Reddy, PC for a Free Case Review today.