Health systems warn of coordinated phishing targeting Epic’s patient portal

August 25, 2026 - 16:27

Hospitals and health networks in several states are sounding the alarm over a coordinated phishing campaign that appears to be targeting users of Epic Systems' MyChart patient portal. The attacks are not new in style, but the scale and consistency of the messages have caught the attention of security teams, with multiple organizations issuing public warnings in the same week.

The fake messages vary in wording, but many share a common hook: they promise a reward, often described as a "MyChart Medicare Kit," and ask the recipient to click a link or enter login credentials to claim it. Some versions claim the patient's account will be suspended unless they verify their identity immediately. The messages are designed to look like official notices from the health system or from Epic itself, complete with logos and familiar formatting.

It is not yet clear how many distinct attackers are behind the effort, or whether it is a single group running a wide net. What is clear is that the campaign is broad, hitting patients at rural clinics, large academic medical centers, and suburban hospital groups alike. Several health systems have posted alerts on their websites and sent messages through their actual patient portals advising users to delete any unsolicited emails or texts that ask for personal information or payment details.

Security experts note that phishing against healthcare portals is not new, but the use of a specific, branded reward like the "Medicare Kit" suggests the scammers are doing their homework. Medicare-related confusion is a common vector, especially among older patients who may be less familiar with how legitimate portal notifications work. The key advice from health systems is simple: never click links in unexpected messages, never share your password, and if you are unsure, open your browser directly to the portal's official website rather than using any link provided in an email.

Patients who believe they may have fallen for the scam are urged to contact their health system's support line immediately and change their portal password. Some organizations are also advising patients to monitor their accounts for unusual activity, such as appointment changes or prescription requests they did not make. So far, there is no public evidence that any patient data has been compromised, but the investigation is ongoing.