FTC; Utah; California Sue Him & Hers Over Business and Data Sharing Practices

Posted by Steve Alder

Him & Hers, a San Francisco, CA-based telehealth company, is being sued by the Federal Trade Commission (FTC) and the states of Utah and California over the company’s business and data sharing practices, which are alleged to violate the Federal Trade Act, Restore Online Shoppers’ Confidence Act, Utah Consumer Sales Practices Act, and California’s False Advertising and Unfair Competition Laws.

Him & Hers is a direct-to-consumer business that provides prescription and over-the-counter medications. According to the complaint, filed last week in the U.S. District Court for the Northern District of California, the company claims to maintain consumers’ privacy yet discloses their sensitive data to third-party advertising platforms, without consumers’ knowledge or consent. In addition, the complaint alleges that the company deceives consumers about its billing and cancellation policies.

Him & Hers used tracking technologies such as Meta Pixel and the Meta Conversions API, which automate the recording of user data based on the Him & Hers website and transmit that information to Meta in response to certain events. Him & Hers also used a variety of advertising tools from companies such as Snap, Microsoft, Google, Criteo, Pinterest, TikTok, Trade Desk, and X, which also collected sensitive consumer information and transferred the information to third-party companies for advertising purposes. Him & Hers is also alleged to have sent lists of certain customers to the Meta and Snap custom audience systems.

Oftentimes, consumers use Him & Hers to obtain medications for sensitive medical conditions such as mental health issues, erectile dysfunction, and premature ejaculation. According to the complaint, until at least mid-2023, Him & Hers claimed that “medical records and sensitive information are only accessed by the medical providers managing your care,” and has claimed in its online advertising that consumers are provided with a “100% online, private, and secure process,” yet sensitive information was being shared with third parties for advertising purposes.

In addition to the unlawful data transfers, the complaint alleges that Him & Hers failed to clearly disclose that consumer prescriptions are charged almost immediately after completing an intake form. Consumers were informed that they could consult with a medical provider to find a suitable treatment and would not be charged unless and until their prescriptions are prescribed. The FTC alleges that Him & Hers rarely provides medical consultations, enrolls customers almost immediately into recurring subscription plans, and makes it difficult for consumers to cancel their subscriptions. For instance, consumers are not informed clearly and conspicuously when their recurring prescriptions will be refilled, which makes it difficult for them to cancel before the next billing cycle. Consumers are also not permitted to cancel subscriptions online, only via the phone, email, or chat, and the complaint alleges that consumers must navigate other hurdles, making it “extremely difficult” to cancel subscriptions.

The lawsuit seeks a permanent injunction preventing the company from engaging in unfair and deceptive business practices, civil penalties, and monetary awards. “The FTC’s complaint lays out a troubling scenario—consumers unknowingly locked into recurring subscriptions and the disclosure to third parties of consumers’ most private health information without their consent,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “The FTC will not hesitate to act on behalf of consumers deprived of their ability to choose which products they want and whether to keep their most sensitive health information private.”

This is not the first time that the FTC has taken action against telehealth companies over the use of tracking technologies. Enforcement actions have previously been filed against the fertility tracking app Premom, BetterHelp, and GoodRx. In each case, the complaints were resolved with financial penalties.

The post FTC; Utah; California Sue Him & Hers Over Business and Data Sharing Practices appeared first on The HIPAA Journal.

AmGen Announces Cyberattack and Data Breach Involving Patient Data

Posted by Steve Alder

Amgen Inc., a Thousand Oaks, CA-based biopharmaceutical company that develops and manufactures pharmaceutical products for oncological, hematological, and cardiovascular diseases, has recently disclosed a cybersecurity incident involving unauthorized access to third-party-hosted cloud storage systems.

In a Form 8-K filing with the U.S. Securities and Exchange Commission (SEC), Amgen explained that it determined in July 2026 that hackers gained access to certain cloud systems. Amgen immediately implemented its cybersecurity response plan, deployed containment measures, and engaged third-party digital forensics experts to determine the nature and scope of the unauthorized activity.

The investigation determined that proprietary data, patients’ protected health information, and other data had been exfiltrated from the cloud environment, and on July 29, 2026, determined that the incident was material and informed the SEC. Amgen said it does not believe the incident is reasonably likely to have an impact on its financial position, nor any of its products, manufacturing operations, financial reporting systems, or its ability to meet patient needs.

Amgen is in the process of assessing the extent to which patient information, confidential business information, intellectual property, research and development, and other information was exfiltrated in the attack and will be unable to accurately determine the impact to the company until those processes have concluded. At present, the exact nature of the attack, such as how the cloud systems were compromised, has yet to be made public. Amgen said it takes the protection of its systems and data very seriously and is in the process of determining the applicable regulatory and legal notification requirements, including its responsibilities under HIPAA.

As of the date of the SEC filing, the threat group behind the attack is unclear. Several pharmaceutical, biotechnology, and medtech firms have fallen victim to cyberattacks in recent months, including Novo Nordisk, Medtronic, Stryker, Abbott Laboratories, West Pharmaceutical Services, and Brainyx AI. The attacks have been conducted by several threat actors, including the Iran-linked hacktivist group Handala and the data theft and extortion groups FulcrumSec and ShinyHunters. The latter was the subject of a recent cybersecurity alert by Health-ISAC after a string of successful hacks on the healthcare sector.

The post AmGen Announces Cyberattack and Data Breach Involving Patient Data appeared first on The HIPAA Journal.

CISA Issues Updated Guidance on Minimum Elements of an SBOM

Posted by Steve Alder

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency (NSA), and 15 international cybersecurity authorities have published joint guidance on the minimum elements of a Software Bill of Materials (SBOM). An SBOM is a detailed list of software components, including open-source libraries and hidden dependencies, together with the creators or vendors associated with those components.

Software supply chains are often large and complex, and vendors can be slow to release patches to address vulnerabilities, especially when those vulnerabilities affect third-party components. Cybercriminals target software supply chains as they often have ample time to exploit vulnerabilities before patches are released. Keeping up to date with vendor patches is important; however, simply applying vendor patches does not guarantee that the software is secure. If an SBOM is obtained from a software vendor, users will be able to identify vulnerable or risky components long before patches are released by vendors, allowing them to implement temporary solutions to protect against software supply chain attacks.

In 2021, the National Telecommunications and Information Administration (NTIA) published guidance on the minimum elements for an SBOM, and the latest guidance replaces that document, incorporating stakeholder feedback obtained following the publication of draft guidance in 2025. “SBOM tooling has advanced, driven by the growing number of organizations generating, sharing, consuming, and analyzing SBOMs,” wrote the authoring agencies. “These advancements enable organizations requesting SBOMs to demand more information about their supply chain and software components than they could have in 2021.”

The latest guidance applies to all software solutions, although additional requirements may be necessary for certain types of software, such as AI-based software systems and software-as-a-service (SaaS) solutions in cloud environments. The authoring agencies recommend using the guidance to ensure that their SBOMs include the minimum requirements and then assessing each software solution to determine if any further efforts are required to improve software transparency.

The update includes an additional ten data fields, updates to eight components to clarify scope and specify expectations, and five minor updates to improve information quality and align the guidance with the latest technical developments. The guidance is aimed at organizations that produce, procure, or operate software, and will allow them to better understand the makeup of their software components and supply chains and make more risk-informed decisions.

The post CISA Issues Updated Guidance on Minimum Elements of an SBOM appeared first on The HIPAA Journal.