01 / EXECUTIVE SUMMARY
Hims & Hers disclosed that an unauthorized third party gained access to systems through a social-engineering attack on two employees and accessed its customer-service software platform.
02 / WHAT HAPPENED
Hims & Hers disclosed that an unauthorized third party gained access to systems through a social-engineering attack on two employees and accessed its customer-service software platform.
The chain distinguishes what appeared valid, what was physically true, which authority followed and what consequence the source documents.
The attacker presented communications or requests that the employees treated as legitimate enough to enable access.
The requesting party was an unauthorized third party, not an approved colleague, customer or operator.
Access was obtained to a customer-service platform and customer information.
The filing confirms access to names, emails and, less frequently, phone numbers, addresses and treatment-category communications; the electronic medical record was not accessed.
Independent confirmation of the human principal and requested action before session or support authority changes.
ECR separates a documented monetary floor from a modeled social and economic consequence envelope. It is not an accounting loss figure.
Public evidence does not disclose a monetary amount or affected population; the range is therefore prior-led and deliberately wide.
Scope and response are company disclosures filed with the SEC; 4SI adds the Presence diagnosis.
Employee identity and session authority became transferable because the system accepted socially engineered actions without an independent proof of accountable intent.
4SI does not claim to have independently verified the underlying event. Scores, boundary analysis and economic ranges interpret published evidence; they are not probabilities, compliance findings, valuations or loss forecasts.
Related cases are editorially connected by domain, authority pattern or missing physical trust boundary.