Hims & Hers confirms data breach of customer support system

Telehealth company Hims & Hers, which sells weight-loss drugs and sexual health prescriptions, has confirmed a data breach affecting its third-party customer service platform. According to the company, hackers broke into its third-party ticketing system—which functions as a customer support software platform—between February 4 and February 7. During this period of unauthorized access, the hackers stole data about user requests sent to the company’s customer support team. While Hims & Hers stated that customer medical records were not affected by the breach, the incident involved the theft of support tickets containing personal information submitted by customers.

Jake Martin, a spokesperson for Hims & Hers, confirmed that the company’s customer support system was hacked after being hit by a social engineering attack. In this type of security exploit, hackers trick employees into granting unauthorized access to internal systems. Martin stated that the stolen data “primarily included customer names and email addresses.” At this stage, it is not yet known how many individuals had personal information compromised in the incident, as the company has not disclosed the specific number of affected users.

The company disclosed the incident on Thursday in a data breach notice filed with the California attorney general’s office, a US state regulator. Under California law, companies are required to disclose data breaches that affect 500 or more state residents. The Hims & Hers incident reflects a broader pattern of security threats targeting customer support software. For context, messaging platform Discord experienced a similar data breach last year that affected its customer support ticketing system, exposing the personal data of around 70,000 people.

Why it matters

The breach of Hims & Hers’ third-party customer support system highlights the growing trend of financially motivated hackers targeting ticketing platforms to steal customer information.