Pennsylvania AG Warns MyChart Users About Fake “Medicare Kit” Phishing

Pennsylvania Attorney General Dave Sunday warned Friday, August 28, 2026 that scammers are impersonating MyChart with emails and texts that offer a “MyChart Medicare Kit.” No such program or reward exists. The lure is meant to steal passwords and personal data so someone else can open a patient’s real portal.

This is phishing and brand impersonation, not a reported MyChart platform hack. Penn Medicine’s safety page (updated August 26, 2026) describes a nationwide scam using MyChart’s name — fake Medicare Kit and Senior Health Package offers — not a clinic outage. CBS Philadelphia reported that Epic has alerts from multiple organizations and that officials say there is currently no evidence MyChart itself was breached. Memorial Hermann published the same nationwide lure on August 21. Syndicated recaps (including Yahoo) are that story again — not a second incident.

This is not a duplicate of the JPS Health Network Fort Worth outage, where MyChart was down after suspicious activity. That post is an availability incident. This one is a consumer-alert phishing wave.

Snapshot

What the Attorney General and Penn Medicine said

Sunday’s office: remain skeptical of unsolicited free offers; do not reply with a password or verification code; do not click unsubscribe on the lure; do not follow “verify / fix / unlock” instructions that move you to a computer. Type the portal your own clinic gave you, or use the official app. File a complaint with the Bureau of Consumer Protection at attorneygeneral.gov, by email, or by phone.

Penn Medicine names the only senders patients should expect:

Help desks: myPennMedicine 866-614-7606; MyLGHealth 717-544-2860. Penn says it will never ask for a password or codes by phone, text, or email. If you already clicked, reset the password on the typed official host.

Do not trust lookalike “Penn Medicine MyChart” search results. Official hosts to type: pennmedicine.org, mychart.org, and the portal hostname your clinic printed — typically mypennmedicine.org, not a near-spell.

What patients should do

1. Type your health system’s MyChart URL or open the app you already installed. Do not use a link from the text.
2. Treat Medicare Kit, Senior Health Package, and any gift-for-health-data offer as fraud.
3. Never read a one-time code to a caller or paste it into a page you did not type.
4. If you clicked: change the portal password on the official host, review recent logins if the tenant shows them, and tell the clinic help desk.
5. In Pennsylvania, report the lure to scams@attorneygeneral.gov or 1-800-441-2555. Nationwide: IC3.

MFA: YubiKey and Google Authenticator

A hardware key does not stop a fake “claim your kit” page you type a password into. It does stop a lot of replay after someone phishes SMS or inbox OTP. Grades match our MFA directory.

Epic’s two-step help documents email or text codes or an authenticator app. The authenticator option is real on the platform page. The row stays Fail because SMS and email OTP remain the documented default. Passkey help says a passkey can live on a security key. Epic does not name YubiKey. We do not invent a YubiKey enrollment button.

Penn’s official safety page documents SMS/email as the public 2FA story. Tenant TOTP and YubiKey are not documented there. Passkeys on a login screen do not promote Fail → Pass while inbox OTP is the published path.

Directory: MFA support directory · Category → Healthcare.

Recommended MFA tools

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Independent cybersecurity audits

We audited the official AG, vendor, and health-system hosts on August 30, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not mean MyChart was hacked.

Audit links: attorneygeneral.gov · epic.com · pennmedicine.org · mychart.org

Portal hostname mypennmedicine.org scored 28% with Identity 0% (no useful mail path). Treat that as a login host, not “Penn’s email was breached.” Transport on attorneygeneral.gov and mychart.org is 15% (MTA-STS / related) — spoofed “AG / MyChart update” mail is easier to deliver than the overall scores suggest.

Website stack note

Passive website-tech probes on August 30, 2026:

Point-in-time only. A live marketing homepage is not a patient-portal forensic finding.

Blacklist and lookalike domains

Email blacklist checks (public DoH, August 30, 2026): attorneygeneral.gov, pennmedicine.org, mychart.org, and epic.com were clear on mail/domain lists we can query. A web/CDN IP on attorneygeneral.gov showed an informational UCEPROTECT Level 3 note — not a mail-reputation hit.

DNS lookalike scans (BEC profile, registered signals only):

High-interest registered names (investigate; not proof this wave used them):

mychart.com and pennmedicine.com overlapped the brand hosts (likely owned). Type mychart.org and pennmedicine.org, not a TLD swap. Continuous monitoring: Cybersquat Domain Monitoring.

Related coverage

• JPS Health Network outage — MyChart down
• Memorial Hermann MyChart phishing alert (Aug 21 — same nationwide lure)
• Healthcare AG breach tracker
• MFA support directory
• Montrose tap-to-pay wallet fraud (linked Memorial Hermann as a sibling only)

Run a free audit at audit.emailmenow.com or contact EmailMeNow for healthcare DMARC / MTA-STS and phishing response aimed at the 100% ideal.

Sources: PA Attorney General — AG Sunday MyChart phishing warning · Penn Medicine — MyChart safety · CBS Philadelphia · Epic MyChart two-step verification and passkeys · Memorial Hermann press release, Aug 21, 2026. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches August 30, 2026. Domain scores: audit.emailmenow.com only.