I almost fell for a spoofed site while online shopping. I remembered when we just worried about viruses, not fake websites. Now, I always check for HTTPS and the correct URL. It's a small step that can save a lot of trouble. Times have changed for sure.
They had sensitive conversations stored that were accessed. From what I've seen, always enable two-factor authentication on any app that handles personal health data.