Fake MyChart Messages Target Patients—Evidence Points to Impersonation, Not a Platform Breach

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Generic patient portal displayed on a laptop and phone with an original blue medical shield, illustrating protection from healthcare phishing. — Original editorial illustration of a generic patient portal protected from phishing; it is not an Epic, MyChart or health-system image and does not depict a breach.

SCAM ALERT

Health systems are warning about emails and texts promising a “MyChart Medicare Kit” or “Senior Health Package.” Epic’s own investigation also documents a separate fake-results campaign that steals logins and may install malware.

Reporting cutoff: August 24, 2026, 5:56 p.m. Eastern (2026-08-24T21:56:56Z)

Across the United States, hospitals and clinics are warning patients about convincing messages that borrow the MyChart name, logo and healthcare language. The most visible wave promises a free “MyChart Medicare Kit,” “2026 MyChart Senior Health Package” or similar wellness gift. The offer is fake.

The most important fact is also the easiest to lose in a frightening headline: the warnings describe criminals impersonating MyChart and healthcare organizations—not evidence that Epic’s MyChart platform was breached. GBMC HealthCare says there is no indication that either GBMC or MyChart was hacked.^[5] MetroHealth, SGMC Health and Methodist Health System say the messages are not theirs.^[2]^[3]^[4] Premier Health has issued the same warning.^[6]

Healthcare Dive reported that more than a dozen health systems had issued warnings by August 24.^[8] The number is changing as organizations publish alerts, so it should not be treated as a victim count. A warning can be proactive and does not by itself establish patient impact.

What is actually happening?

Epic’s MyChart safety page says scammers are using the MyChart name or logo across emails, texts, calls and websites. The goal can be login theft, payment-card theft, personal-data collection or malware installation.^[1]

Epic describes two separate phishing campaigns observed in its security investigations during summer 2026—not one confirmed operation with one proven operator.^[1]

Campaign 1: A fake lab-results portal

The first campaign starts with an email claiming that recent results are ready. Its link opens a copied MyChart-looking sign-in page that asks for an email address and password. A fake medical chart then displays an alarming “AI-powered” blood-work warning to create urgency.^[1]

The attack can continue in either of two dangerous ways:

A fake “human verification” directs the visitor to press Windows+R, paste clipboard content and press Enter. Those keystrokes run a hidden command and install malware.^[1]
An August variant offers an executable “full analysis report” and tells the visitor to bypass Windows security warnings.^[1]

A legitimate lab result does not require a downloaded Windows program, a Run dialog or commands pasted from a website. If a page tells you to ignore a security warning, stop.

Campaign 2: The fake Medicare kit or senior package

The second campaign says the recipient was selected for a 2026 Medicare health kit, free first-aid kit or senior wellness package. The wording changes, and the link may bounce through unrelated advertising sites before displaying a MyChart-branded survey.^[1]

The page uses a countdown, fake stock limits and a supposed $149 product reduced to $0. The “free” reward then requires a shipping payment. Epic’s documented example asks for the person’s name, email address, phone number, mailing address and card details. No kit ships.^[1]

This campaign matches the warnings now being published by health systems. MetroHealth says the messages may ask recipients to click a link, confirm an address or provide personal information.^[2] SGMC says the lures use email and text messages and may request personal, financial, insurance or Medicare information.^[3]

One campaign or many?

The safest evidence-led answer is multiple phishing waves under the same trusted brand.

Epic explicitly documents two campaigns: fake lab results and a fake Medicare kit.^[1]
Multiple health-system alerts share the same “Your MyChart Medicare Kit Awaits!” subject line, gift theme and requested data, strongly suggesting a common lure family.^[4]^[6]
Epic says the wording and destination can change from recipient to recipient. That makes it unsafe to assume every message, domain or sender belongs to one operator.^[1]
No primary source reviewed by The IT Guys publicly attributes the activity to a named group, proves one command structure or reports a MyChart platform compromise.

In other words, the Medicare-kit messages appear related by template and technique, but shared branding is not enough to prove a single coordinated criminal organization.

Which health systems have warned patients?

Primary warnings reviewed for this article include:

MetroHealth in Ohio: fake senior-health-package, Medicare-benefit and free-kit emails.^[2]
SGMC Health in Georgia: fraudulent emails and texts promoting kits, rewards or wellness products.^[3]
Methodist Health System in Texas: patient reports of “Your MyChart Medicare Kit Awaits!” emails.^[4]
GBMC HealthCare in Maryland: email and text impersonation; no indication GBMC or MyChart was hacked.^[5]
Premier Health in Ohio: fraudulent kit emails designed to steal personal information.^[6]
Kettering Health in Ohio: fake offers requesting personal, financial, insurance or login data.^[7]

Healthcare Dive has identified additional warning systems beyond the six primary alerts listed above. Because organizations may warn proactively or after reports, this is a warning-source list, not a list of breached systems or confirmed victims.^[8]

Why the messages can look convincing

MyChart is familiar, and legitimate healthcare organizations really do send appointment, billing and test-result notifications. Criminals exploit that normal behavior.

A logo proves nothing. A sender’s display name can be forged, and a link’s visible words can differ from its real destination. Even a padlock only means the connection to that website is encrypted—it does not establish that the site belongs to your hospital.

Watch for:

unexpected gifts, Medicare kits, rewards or “senior packages”;
a request for a password, verification code, card, Social Security, Medicare or insurance information;
a countdown or threat that pressures you to act immediately;
an unfamiliar sender address, misspelled domain or extra words in a web address;
a link that opens an unrelated survey or several advertising pages;
an “unsubscribe” link inside a suspicious message;
instructions to press keyboard shortcuts, paste a command, download a program or bypass a security warning.

Epic says neither it nor a healthcare organization will ask for a MyChart password or verification code by phone, text or email. MyChart also does not run giveaways.^[1]

The safest way to check a MyChart notification

Do not use the message’s link, button, attachment, phone number or unsubscribe link.
Open the MyChart mobile app you already use, a saved bookmark, or your health system’s website typed manually.
Look for the claimed result, bill, appointment or message after signing in through that trusted route.
If it is not there, contact your provider using a number from its official website or a bill already in your possession. For an insurance or Medicare question, use the number on the official insurance or Medicare card.
Report the suspicious email as phishing or junk, then delete it.

The FTC gives the same core rule: contact the organization through a phone number or website you already know is real—not the information in the message.^[9]

What to do if you interacted with the scam

You clicked but entered nothing

Close the page. Do not return to click “unsubscribe.” Report the message as phishing. Epic says a person who clicked but entered nothing is most likely fine, but should remain alert.^[1]

You entered a MyChart password

Use the official app or provider website to change it immediately.
Change it anywhere else you reused the same password.
Review the email address, phone number and other account details on file.
Contact the healthcare organization’s official MyChart help desk.
Review recent portal activity and messages with the organization.

You disclosed a verification code

Change the password immediately and call the organization’s official support number. A real one-time code does not make the person asking for it legitimate.

You entered card or bank information

Use the number printed on the card or the financial institution’s official app or website. If card details were exposed, report the card as compromised and ask about replacement. If bank-account details or online-banking credentials were exposed, contact the bank’s fraud department and follow its instructions for securing or replacing the affected account. Review transactions for test charges, unauthorized transfers and recurring payments.^[1]

You provided Social Security, Medicare, insurance or identity information

Report the incident at IdentityTheft.gov and follow its recovery plan. Contact Medicare through the number on the official Medicare card or Medicare.gov—not a number in the suspicious message. The FTC warns that phishing can be used to steal passwords, account numbers and Social Security numbers.^[9]

You ran a command or downloaded a program

Disconnect the computer from Wi-Fi or Ethernet. Do not use it for medical, financial or work accounts. Have a trusted IT professional inspect it before reconnecting. Change important passwords from a different, clean device.

What health systems and businesses should do

Healthcare organizations should publish recognizable alerts through their own domains and patient portals, monitor look-alike domains and sender abuse, and give patients a trusted support path. Email defenses should inspect impersonation, redirects and attachment behavior rather than relying only on display names.

Businesses supporting patients or caregivers should treat a device that followed the fake verification steps as potentially compromised. Preserve the original message and endpoint telemetry, isolate the device, investigate process execution and reset exposed credentials from a clean system.

Bottom line

The MyChart name is being abused because patients recognize and trust it. That does not make MyChart itself malicious, nor does the current evidence show a platform breach. The strongest protection is simple: when a health message creates urgency or offers something free, leave the message and reach MyChart through your own trusted route.