Salem Health patients are among those targeted by a nationwide phishing scam that uses fake MyChart messages to steal personal information.
According to The Lund Report, which reported the story on Aug. 24, that two Oregon health systems have warned patients about the fraudulent emails.
The scam messages promise a "MyChart Medicare Kit," a "2026 MyChart Senior Health Package" or other free wellness products. None are real.
The messages arrive by email, text and phone call, often with subject lines like "Your MyChart Medicare Kit Awaits!"
They use MyChart's name and logo to appear legitimate, but clicking the links takes patients to a fake website designed to harvest login credentials, Medicare numbers and other sensitive data.
The campaign specifically targets elderly patients and Medicare enrollees. Patients receive legitimate MyChart notifications routinely for appointment reminders, test results and billing, which makes a scam message carrying the MyChart name less likely to trigger suspicion than a fake bank or package-delivery notice.
A MyChart account can hold diagnoses, medications, lab results, insurance details and message threads with clinicians. Medicare numbers are especially valuable to fraudsters because they are not routinely reissued.
As of Tuesday, Aug. 25, at least 30 health systems nationwide had either issued warnings or confirmed patients received the messages, according to a running tally reported by Medical Daily. That count was just six or seven earlier in August.
Epic Systems, the company that operates MyChart for approximately 190 million American users, confirmed the portal itself was not hacked. Trevor Berceau, Epic's director of research and development, posted a public warning on MyChart.org on July 27.
"The increase in attempts is due to scammers taking advantage of the popularity of the MyChart brand rather than any security concern, so you can continue to use MyChart as normal," Berceau wrote. "If something doesn't feel right, however, stop and check."
How to protect yourself
Health systems and Epic advise patients who receive a suspicious message to:
- Not click any links
- Not open attachments
- Not reply to the sender
- Not provide personal, financial, insurance or Medicare information
- Delete the message immediately, including not clicking the "unsubscribe" button
Red flags include spelling or grammatical errors, unfamiliar or nonsensical email addresses and congratulations for "winning" a health kit.
The safest way to access MyChart is to open the app directly or type your health system's web address into a browser rather than following links in any email or text.
If you already clicked
Patients who entered credentials on a suspicious site should change their MyChart password immediately and change it anywhere else the same password was used. Those who shared Medicare or insurance details should monitor statements and explanation-of-benefit notices for unfamiliar claims, which may not appear for weeks.
Patients can contact Salem Health directly to report suspicious messages or confirm whether a communication is legitimate.
