PHILADELPHIA, August 30 — Penn Medicine and Pennsylvania Attorney General Dave Sunday have issued a joint warning to patients about a nationwide phishing campaign targeting users of MyChart, the patient portal that links individuals to their health records and provider communications across health systems.
The scam exploits trust in the MyChart brand by sending fraudulent emails and text messages that falsely advertise a nonexistent “MyChart Medicare Kit” or “Senior Health Package.” Recipients are directed to malicious links designed to steal passwords and personal data, giving attackers unauthorized access to medical information. Officials stress that no legitimate “MyChart Medicare Kit” program exists.
The Pennsylvania Office of Attorney General confirmed the messages are part of a coordinated effort to harvest credentials from patients who rely on digital health tools for managing their care. Phishing attacks on health‑care platforms have risen sharply in recent months, prompting alerts from both Penn Medicine and state officials. The campaign underscores growing risks as more patients use online portals to schedule appointments, view test results, and communicate with providers.
“These deceptive messages prey on vulnerable seniors and caregivers who expect official communications from trusted health systems,” Attorney General Dave Sunday said in a statement. “We urge everyone to verify any unsolicited request for personal information and to report suspicious activity immediately.” Penn Medicine has advised patients to delete unsolicited messages, avoid clicking on unknown links, and contact their health system’s support team if they receive a questionable outreach.
The health system also recommends enabling multi‑factor authentication on MyChart accounts to add an extra layer of security. State officials say the scam reflects a broader trend of cybercriminals targeting digital health infrastructure, where stolen credentials can lead to identity theft, insurance fraud, and unauthorized access to sensitive medical records. Patients are encouraged to remain vigilant and to share awareness with family members, especially older adults who may be less familiar with phishing tactics.
By staying informed and adopting protective measures, communities can help safeguard personal health data in an increasingly digital landscape.
Sources
Background and why it matters
Epic Systems built the MyChart platform that powers patient portals for many U.S. health systems. The company launched its first electronic health record system in 1979 and grew to dominate the market, eventually linking hundreds of hospitals to a single software suite.
MyChart lets patients view test results, schedule appointments, and message providers through a secure web portal. The platform connects users to their health records across different hospitals and clinics, creating a unified digital view of personal medical history.
Because MyChart holds sensitive medical information, it has become a frequent target for cybercriminals seeking to steal login credentials. Recent phishing attempts have used fake “MyChart Medicare Kit” offers to trick recipients into revealing passwords, prompting alerts from health systems and attorney general offices.
The scam exploits the trust patients place in a widely used digital health tool, highlighting the growing risk of credential theft in modern health care. As more medical services move online, protecting portal accounts has become essential for safeguarding personal health data.
