A healthcare technology company has confirmed a data breach affecting nearly 1.4 million individuals after a phishing attack gave unauthorized actors access to sensitive personal and medical information.