MyChart phishing scams are actively targeting patients worldwide with fraudulent emails, text messages, and phone calls designed to steal personal information and account passwords, according to a warning issued by the medical portal company. The campaign exploits the popularity of the patient portal brand, which serves roughly 190 million users globally, by pushing fake medical results, critical blood work warnings, and unsolicited promotional offers like a 2026 Medicare Health Kit.
How the MyChart Phishing Attacks Work
Attackers are leveraging the recognizable MyChart logo and name to construct convincing digital traps. According to the portal’s operator, one primary vector involves an email notification encouraging recipients to click a link to view supposed medical results. This action redirects victims to a counterfeit login page or displays alarming notices regarding urgent blood work, ultimately exposing user devices to malware or harvesting login credentials. Gizmodo obtained 166 Federal Trade Commission complaints spanning five years regarding the platform through a Freedom of Information Act request, highlighting that cybercriminals have targeted the brand’s user base over multiple years.
Health System Warnings and Regional Alerts
Texas Health, South Dakota-based Avera Health, Methodist Health System in Texas, Premier Health in Ohio, and Sentara Health in Virginia are among the organizations reporting the activity. In Pennsylvania, Attorney General Dave Sunday issued a public warning urging residents to remain vigilant against these tactics. Local providers have also stepped up communications; Penn Medicine confirmed it received a small number of reports concerning fraudulent emails and text messages advertising a free “MyChart Medicare Kit” or “Senior Health Package,” prompting the system to post guidance on its website. Main Line Health similarly reported taking proactive steps to protect patient privacy, though neither system has recorded impacted accounts at this stage, while Cooper Health reported zero received complaints.
Pro Tip: Epic Systems, the parent company of MyChart, notes that portal notifications will always feature a specific doctor or healthcare provider. If an unexpected message arrives offering “free” services or demanding urgent action, do not click any links. Always access the platform directly through the official mobile application or your provider’s verified web address.
Protecting Your Medical Account and Credentials
Security experts emphasize that MyChart does not conduct giveaways or promotions for senior health packages. According to Epic’s Trevor Berceau, director of research and development, the recent surge in fraudulent messages stems from bad actors capitalizing on brand recognition rather than an underlying security breach within the infrastructure. Health systems advise anyone who suspects they have clicked a malicious link or entered a password on an unverified site to change their credentials immediately and contact their medical provider’s office directly to confirm legitimate communication channels.
Frequently Asked Questions
Will MyChart ever email or text me to claim a free offer?
No. According to Epic Systems, MyChart does not run giveaways, and users should be highly skeptical of any unexpected messages promoting free items like Medicare kits or health packages.
How can I safely check my actual medical results?
Patients should bypass email links entirely and instead open the official MyChart mobile app or navigate directly to their healthcare organization’s verified website.
What should I do if I clicked a suspicious link?
Anyone who entered a password on an unverified page should change their account password immediately and reach out to their doctor’s office to report potential compromise.
Stay Informed: Have you received a suspicious message claiming to be from your healthcare provider? Share your experience in the comments below, and subscribe to our newsletter for ongoing updates on cybersecurity and patient privacy.
Worth a look