In the quiet trust that patients place in their healthcare portals, criminals have found an opening. Scammers are impersonating MyChart — the widely used patient health platform — through convincing fake emails and texts designed to harvest login credentials and personal medical information, with patients at Lancaster General Hospital and Penn Medicine among those specifically targeted. The breach of this particular trust carries unusual weight: health information is among the most intimate data a person holds, and its theft can ripple outward into identity fraud, corrupted medical records, an
Phishing scam impersonates MyChart, targeting patient health records
Patient personal and medical information is at risk of theft through credential compromise via phishing attacks.
Never click a link in an unsolicited message, no matter how official it looks.
Mark
So these are just phishing emails pretending to be MyChart? How many people have actually been compromised?
Mimi
That's the thing—the reporting doesn't give us a specific number of victims. We know LGH and Penn Medicine patients have been targeted, and multiple news outlets are covering it, which suggests it's widespread enough to warrant public warnings. But the actual damage count isn't in the reporting.
Luke
Right. We know the scam exists and that it's targeting these health systems, but we don't have confirmation of how many people fell for it or how many accounts were actually breached. The warnings are preventive, which is good, but it means we're looking at a threat that's being taken seriously before we have a full accounting of the harm.
Mark
What makes MyChart such a target compared to other patient portals?
Mimi
It's used by a lot of major health systems—it's one of the most common portals in the country. That means there are millions of potential victims, and criminals know that. If you're going to run a phishing campaign, you want to cast a wide net.
Luke
But we should note that the reporting doesn't actually compare MyChart to other portals or explain why this one specifically is being targeted now. It could be that MyChart is more vulnerable, or it could just be that it's the biggest target. We don't know from what's been reported.
Mark
What should someone actually do if they get one of these messages?
Mimi
Don't click any links. Don't enter your information. Call your healthcare provider directly using a phone number you know is real—not one from the message. Go to the MyChart website or app directly without clicking any links from the message.
Luke
That's solid advice and it's what the health systems are saying. The one thing we don't have is clarity on what a fake MyChart message actually looks like versus a real one. The reporting tells you to be suspicious, but it doesn't show you the red flags—misspellings, wrong sender addresses, suspicious links. That would be genuinely useful.
Mark
Is this a new kind of attack or has this been happening for a while?
Mimi
The reporting frames it as a current scam that's active enough to warrant warnings from major health systems right now. It's not clear if this is brand new or if it's been going on and just recently got enough attention to trigger public alerts.
Luke
Exactly. We know it's happening now and it's serious enough that hospitals are warning patients. But we don't have a timeline—when did it start, how long has it been running, is it accelerating. That context would help people understand whether this is an emerging threat or an ongoing problem that's finally getting coverage.
Le Pouls
- Fraudsters are sending polished, official-looking MyChart messages designed to be nearly indistinguishable from legitimate communications, exploiting the trust patients extend to their healthcare providers.
- LGH and Penn Medicine have issued direct warnings, signaling the threat is widespread and targeted enough to demand institutional response.
- A compromised MyChart account opens the door not just to medical records, but to Social Security numbers, insurance data, and a pathway to broader identity theft and dark web exposure.
- Health systems are urging patients to stop before clicking — go directly to the MyChart app or website, or call their provider's main number to confirm any suspicious message.
- The scam persists because it works: busy people, institutional trust, and a well-crafted fake message are a reliable combination that criminals continue to exploit successfully.
In the quiet trust that patients place in their healthcare portals, criminals have found an opening. Scammers are impersonating MyChart — the widely used patient health platform — through convincing fake emails and texts designed to harvest login credentials and personal medical information, with patients at Lancaster General Hospital and Penn Medicine among those specifically targeted. The breach of this particular trust carries unusual weight: health information is among the most intimate data a person holds, and its theft can ripple outward into identity fraud, corrupted medical records, and lasting financial harm. The antidote, as ever, is the pause — the deliberate moment of verification before action.
Criminals are sending fake MyChart emails and text messages crafted to look official, aiming to steal the login credentials and personal health information of patients across the country. The scam has grown visible enough that Lancaster General Hospital and Penn Medicine have issued formal warnings, urging their patients to treat any unsolicited MyChart message with suspicion.
MyChart's value to patients — access to medical records, appointment scheduling, provider communication — is precisely what makes it valuable to criminals. The phishing messages typically prompt recipients to verify account details, reset a password, or click a link, all leading to fake websites designed to capture usernames and passwords. The consequences of a stolen login extend well beyond inconvenience: scammers can access medical histories, harvest insurance and Social Security information, and use stolen credentials as leverage for broader identity theft.
The guidance from affected health systems is consistent and simple: do not click any link in an unsolicited message claiming to be from MyChart. Navigate to the app or website independently, or call your provider directly to confirm whether a message is real. Phishing attacks endure because they exploit the combination of institutional trust and human busyness — a convincing fake, seen quickly, can fool almost anyone. The most reliable defense is also the most unglamorous: slow down, verify, and never let urgency override caution.
Fraudsters are sending fake emails and text messages that appear to come from MyChart, the patient portal used by hospitals and clinics across the country, in an attempt to steal login credentials and personal health information. The scam has been reported widely enough that health systems including Lancaster General Hospital and Penn Medicine have issued direct warnings to their patients, urging them to be cautious about any unsolicited messages claiming to be from the portal.
MyChart is a legitimate tool that lets patients access their medical records, schedule appointments, and communicate with their healthcare providers online. Because it holds sensitive information—names, dates of birth, insurance details, medical histories—it is an attractive target for criminals. The phishing messages typically ask recipients to verify their account information, reset a password, or confirm personal details, using language and formatting designed to look official. Some arrive as emails; others come as text messages. The goal is straightforward: trick someone into entering their username and password on a fake website, or revealing enough personal information to compromise their account.
Patients at LGH and Penn Medicine have been specifically targeted, though the scam appears to be broader. The healthcare systems have responded by warning their patient populations to scrutinize any message asking them to click a link or provide account details. The advice is consistent across institutions: if you receive a message claiming to be from MyChart, do not click any links in it. Instead, go directly to the MyChart website or app on your own, or call your healthcare provider's main phone number to verify whether the message is legitimate.
The risk here is not merely inconvenience. Once a scammer has a patient's MyChart login, they can access medical records, potentially modify information, or use the stolen credentials as a stepping stone to other accounts. They can also harvest personal data—Social Security numbers, insurance information, addresses—for identity theft or sale on the dark web. For patients, the consequences can include fraudulent charges, compromised medical records, or the discovery that their information has been used to open accounts in their name.
Healthcare organizations have been warning about phishing for years, but the attacks persist because they work. People are busy, they trust institutions, and a well-crafted fake message can be hard to distinguish from the real thing at a glance. The current wave targeting MyChart users is a reminder that no one is too careful when it comes to health information. The best defense remains the simplest: never click a link in an unsolicited message, no matter how official it looks. Call your provider directly if you're unsure. Verify before you act. The criminals are counting on speed and panic; taking thirty seconds to double-check can save you months of headache.
Citations marquantes
Do not click any links in unsolicited messages claiming to be from MyChart. Instead, go directly to the MyChart website or call your healthcare provider's main phone number to verify.— Health system guidance
Envie de l'histoire complète ?
Lire l'original sur Google News ↗
Health & Medicine