Fake MyChart Portal Alerts Hit Patients as County Pays $128K Ransom

KEMETIC MINDS
Cybersecurity & Scam Daily Briefing — September 02, 2026

Photo: Gustavo Fring via Pexels (source)

Key Takeaways

• Philadelphia health systems warn of a phishing scam mimicking MyChart patient portals (Bing News, 2026a).
• Paradise Valley parents got texts claiming their child’s meal account was overdue (Bing News, 2026b).
• Leaked Pocket Bitcoin files tie 291 customers’ names and addresses to public wallet activity (CryptoSlate, 2026).
• The Keystone Newsroom independently flags MyChart portal phishing (The Keystone Newsroom, 2026).
• Winona County paid $128k after a ransomware attack; experts warn other agencies (KAAL TV, 2026).

1. Fake MyChart Medicare Portal Scam — Philadelphia

Watch how a real fake patient portal login unfolds — and the red flags that give it away.

Philadelphia-area health systems are warning residents to watch for an online phishing scam that mimics MyChart, the secure online patient portal used by most leading health systems (Bing News, 2026a). The campaign is described in a Bing News report as a MyChart Medicare phishing scam that has raised concern across the region (Bing News, 2026a).

The danger is that patients receive messages that look like they come from their hospital’s secure portal, built to steal login details or personal information (Bing News, 2026a). The published alert text does not spell out the exact wording of the lure yet, so the safest assumption is that any unsolicited MyChart or Medicare message is hostile until verified (Bing News, 2026a).

How to Avoid This Scam

• Never click a login link inside an email or text about MyChart or Medicare — open your browser, type the official portal address yourself, and sign in there (Bing News, 2026a).
• If a message demands payment, card numbers, or a Medicare ID, call the hospital using the phone number published on its official website — never the number inside the message (Bing News, 2026a).
• Check the sender address and URL closely; portal-themed fakes often use addresses that look right at a glance but are slightly misspelled.
• Report suspicious messages to your health system’s help desk or security team so it can confirm whether it is part of the active campaign (Bing News, 2026a).

2. Paradise Valley School Lunch ‘Overdue Balance’ Text Scam

Watch how a real fake overdue lunch balance text unfolds — and the red flags that give it away.

School officials in the Paradise Valley School District warned parents after a text-message phishing scam claimed a student’s school meal account had an overdue balance (Bing News, 2026b). The warning, covered by Bing News, tells families the texts are not from the district.

These “smishing” text scams create money urgency around a believable hook like a school lunch account, which can push parents to tap a link or share payment details quickly (Bing News, 2026b). The district’s public warning is the official response, so families who verify any account balance through real district channels have a safe path (Bing News, 2026b).

How to Avoid This Scam

• Do not tap links in unexpected texts about lunch money; open the meal account through the official app or the district’s website.
• If the text threatens a late fee, a frozen account, or says your child “can’t eat,” slow down and call the school office — manufactured urgency is the tell.
• Never enter a debit card, credit card, or bank number into a page you reached from an SMS link (Bing News, 2026b).
• Report the text to the district and delete it, so other families can be alerted (Bing News, 2026b).

3. Pocket Bitcoin Leak Reveals 291 Users’ Names and Wallets

Watch how a real breach follow-up phishing unfolds — and the red flags that give it away.

Pocket Bitcoin, a Swiss non-custodial Bitcoin service — meaning it never held customers’ private keys — said copied support records exposed identity and compliance data for 291 customers, sometimes matching real names directly to public Bitcoin activity (CryptoSlate, 2026). An August 31 update expanding its August 21 disclosure says the files contained varying combinations of names, postal addresses, Bitcoin addresses, identity-document copies, and source-of-funds records (CryptoSlate, 2026).

The money itself is safe: spending Bitcoin requires a valid signature made with the corresponding private key, the secret code that unlocks it, and the company reported no risk to customer funds (CryptoSlate, 2026). The real dangers are privacy and deception — anyone can inspect the balance and history of a public Bitcoin address, and Swiss authorities have documented scams that use a victim’s real home address to increase pressure (CryptoSlate, 2026).

How to Avoid This Scam

• Assume any Bitcoin address tied to your name is public forever; the leaked data just removed the separation between your offline identity and blockchain activity (CryptoSlate, 2026).
• Treat any email, call, or text that mentions Pocket Bitcoin or this breach as a possible scam, and reach the company only through its official website (CryptoSlate, 2026).
• If a message quotes your real home address to “prove” it is legitimate, that matches a documented pressure tactic — delete it or hang up (CryptoSlate, 2026).
• Change the password on any email tied to the affected accounts and turn on two-factor authentication wherever it is available.

4. Keystone Newsroom Confirms MyChart Portal Phishing

Watch how a real fake patient portal login alert unfolds — and the red flags that give it away.

A separate report from The Keystone Newsroom, published Tuesday, warns that a phishing scam is targeting MyChart patient portal users (The Keystone Newsroom, 2026). It independently echoes the Philadelphia-area health system alerts, meaning two credible sources are flagging the same campaign (The Keystone Newsroom, 2026; Bing News, 2026a).

For patients who use MyChart, the takeaway is straightforward: do not let a familiar hospital logo lower your guard, and verify any portal-related message through the secure app or a web address you typed yourself (The Keystone Newsroom, 2026).

How to Avoid This Scam

• Before answering any MyChart message, open your health system’s portal the way you always do and look for the same alert inside the secure app.
• Legitimate portals do not ask for your full password, Medicare number, or card details through email or text.
• If you already clicked a suspicious link and entered your login, change your MyChart password immediately and tell your health system’s security team.

5. Winona County’s $128k Ransomware Payment

Watch how a real ransomware negotiation email unfolds — and the red flags that give it away.

Winona County paid $128k following a ransomware attack, and cybersecurity experts are using the case to issue a warning (KAAL TV, 2026). The KAAL TV report, published September 1, does not describe how the attack began or which county systems were affected (KAAL TV, 2026).

Ransomware attacks hold an organization’s systems hostage until money is paid, and a county payout of this size is exactly the outcome experts are warning others to try to prevent (KAAL TV, 2026). For residents, the practical lesson is about preparedness: strong household backups reduce the damage any future attack can do to your own files (KAAL TV, 2026).

How to Avoid This Scam

• If your county or city reports a ransomware attack, expect follow-up scams pretending to be from county offices, and verify every contact through official channels (KAAL TV, 2026).
• Keep backups of important photos, documents, and tax files on a separate drive or service so no one can hold your data hostage.
• Follow the county’s official website and local news for real updates instead of relying on forwarded messages or screen-shotted alerts.

What the Research Actually Says

No peer-reviewed studies were included in today’s research feed, and this briefing does not invent findings that are not there. Every fact above comes from the named news reports and is cited inline (Bing News, 2026a, 2026b; CryptoSlate, 2026; KAAL TV, 2026; The Keystone Newsroom, 2026).

When peer-reviewed research is available in a future briefing, this section will explain in plain language what a study actually found, who was studied, and what it means for how your family should react to the day’s scams.

Today’s Family Safety Checklist

• Treat every urgent money message — an overdue lunch bill, a Medicare portal warning, a wallet “verification” — as a script designed to rush you (Bing News, 2026a, 2026b; CryptoSlate, 2026).
• Reach official services only through addresses you type yourself or save as bookmarks, never through links inside texts or emails.
• Assume data that leaks once — a school account, a patient portal, a crypto compliance file — can surface again in future scams, so use unique passwords for each account (CryptoSlate, 2026; The Keystone Newsroom, 2026).
• Take one protective action tonight: back up your files, turn on two-factor login for email, or show someone in your family what today’s scam texts look like (Bing News, 2026b; KAAL TV, 2026).

References

1. Bing News. (2026, September 2). MyChart Medicare phishing scam raises concern among Philadelphia health systems. msn.com
2. Bing News. (2026, September 1). Paradise Valley School District warns parents of text message phishing scam. msn.com
3. Bing News. (2026, September 1). Leaked compliance records shatter anonymity of 291 crypto users by matching names directly to wallet activity. cryptoslate.com
4. The Keystone Newsroom. (2026, September 1). Phishing scam is targeting ‘MyChart’ patient portal users – The Keystone Newsroom. news.google.com
5. kaaltv.com. (2026, September 1). Cybersecurity experts issue warning after Winona County pays $128k following ransomware attack – kaaltv.com. news.google.com