MyChart hasn’t been hacked. Nobody’s data has leaked out of Epic Systems’ platform, and the company says its security is unaffected. And yet dozens of health systems, from academic medical centers to rural critical access hospitals, have spent the past few weeks independently warning patients about the same phishing scam bearing MyChart’s name, revealing how a MyChart phishing scam brand trust dynamic, not a software vulnerability, is driving this wave of alerts.
The Scale of This MyChart Phishing Scam Brand Trust Campaign
Becker’s has tracked the number of health systems issuing warnings climb quickly: seven in mid-August, then 21, then over 40 by the beginning of September, and counting. The fraudulent emails, which use subject lines such as “Your MyChart Medicare Kit Awaits!” and dangle a free “Senior Health Package,” direct recipients to a fake website built to harvest login credentials and personal information.
How Convincing the Fake Website Actually Is
Epic has said the site, mychart-epic[.]com, copies the real MyChart website’s code, and some of the fake correspondence even signs off from a “MyChart Health Network” at an address in Verona, Wis., Epic’s actual headquarters, a level of detail that makes the scam considerably harder for an average patient to identify as fraudulent.
Why Scale Alone Explains This MyChart Phishing Scam Brand Trust Problem
That level of detail only pays off because of scale. This is licensed by thousands of hospitals and clinics nationwide, which means a single templated email can plausibly land in the inbox of a huge share of U.S. patients regardless of which health system they actually use. A scammer impersonating a single hospital’s portal reaches that hospital’s patients. A scammer impersonating MyChart reaches almost everyone.
Why Trust, Not Just Scale, Makes This Scam Effective
Scale alone doesn’t explain the lure, though. Patients have spent years being trained to expect legitimate correspondence through MyChart: lab results, appointment reminders, billing statements, insurance verification, Medicare enrollment links. That routine familiarity is exactly what a phishing campaign needs to work. A “MyChart Medicare Kit” offer isn’t a wild claim to someone who already receives real Medicare and billing information through that same portal. The scam isn’t inventing trust; it’s borrowing trust patients already extend to the brand for legitimate reasons.
Epic’s Response to This MyChart Phishing Scam Brand Trust Situation
In response to a request for comment, Epic pointed Becker’s to a July 27 post on MyChart.org. In it, Trevor Berceau, director of research and development at Epic, attributed the rise in scam attempts to scammers “taking advantage of the popularity of the MyChart brand,” and said patients can continue using this as normal.
Why This Framing Leaves Health Systems on Their Own
That framing is accurate, but it also draws a line that leaves health systems on the other side of it. Because Epic’s platform itself hasn’t been compromised, there’s no vendor patch and no single incident to report. Each health system has had to discover the campaign on its own, often after patients forwarded the suspicious emails, and post its own warning using its own communications and security staff, resulting in more than 40 versions of essentially the same notice because there’s no coordinated alternative.
How This MyChart Phishing Scam Fits a Broader Shared-Vendor Risk Pattern
That pattern isn’t unique to MyChart. Healthcare organizations are more susceptible to phishing than nearly any other major industry, and the sector’s growing reliance on a small number of shared vendors has become its own risk multiplier. The MyChart scam is a lower-stakes version of the same logic: when most hospitals share one vendor, that brand becomes a single point of leverage, whether what’s exploiting it is ransomware or simply a spoofed email.
Why This Concentration Risk Extends Beyond Phishing
This same dynamic, where widespread reliance on a single dominant vendor creates outsized systemic risk, applies equally to more severe threats like ransomware attacks targeting shared healthcare technology infrastructure, suggesting the MyChart phishing campaign illustrates a structural vulnerability pattern that extends well beyond this particular scam.
What This MyChart Phishing Scam Brand Trust Situation Means Going Forward
With no single vendor patch available to resolve the underlying issue, health systems should expect this pattern of independent, duplicative warnings to continue as long as the campaign persists, since each organization must discover and respond to the scam using its own resources rather than relying on a centralized fix from Epic. Given that scale and trust, rather than any software flaw, are driving this scam’s effectiveness, patient education efforts may prove more valuable than technical remediation in reducing its impact going forward.
What to Watch Going Forward
As the number of health systems issuing warnings continues climbing past 40, industry observers will likely watch whether Epic or industry groups eventually coordinate a more unified response, such as a shared advisory template or centralized reporting mechanism, to reduce the duplicative effort each health system currently bears alone. Given the broader pattern of healthcare’s growing reliance on shared vendors as a risk multiplier, this MyChart phishing scam brand trust episode may prompt renewed discussion about how the industry can better coordinate responses to brand-impersonation campaigns that exploit widely adopted, trusted healthcare technology platforms.
For more healthcare industry updates, insights and news, visit DistilINFO. Click here to subscribe to stay informed.
