10 September 2026: Enara Health detected suspicious activity on its provider application, disabled accounts, reset passwords and later determined an unauthorised party obtained data from that app. Census unpublished. See the Enara Health breach record.
The California AG sample letter dated 6 November 2026 is the primary source. The company says the network and other systems were not reached. Access lasted a limited time that day. Helpline 844-971-8639, 8 a.m. to 5:30 p.m. CT weekdays.
What happened at Enara Health?
Suspicious activity on the provider application 10 September. Passwords changed, impacted accounts disabled, federal law enforcement notified, specialists retained. Forensics: unauthorised access for a limited time that day, data on the application obtained. No evidence of identity theft at letter time.
Enara is a digital weight-management and obesity-treatment network. A provider-app copy can include patients and clinicians. The sample letter uses a mail-merge token for the field list, so the CA PDF itself does not print the fields.
What data was exposed?
HIPAA Journal: names, email addresses, phone numbers, dates of birth, provider names, and limited self-reported medical information, mix by person. recordsAffected stays 0. Do not use aggregator pages that invent 5,066 without a primary filing total we can read.
Self-reported weight-management data plus a phone number is enough for targeted medical phishing. It is not, on the current list, an SSN dump.
The El Camino Health post is a same-season health notice with SSNs. Different path and field mix.
Who is affected?
People whose information sat in the provider application during the 10 September window. Patients and possibly providers. Census unpublished. Someone who only used Enara after that day is not automatically in the copy.
More on the company is on the Enara Health company page.
What should patients do?
- Call 844-971-8639 if you are unsure whether you are in the file.
- Change the Enara password and any reused password.
- Treat weight-loss 'records restore' texts as hostile.
- The sample letter does not list SSNs. Still watch accounts if your letter names extra fields.
- Enara will not collect a card CVV through a new domain.
HIPAA Journal on 11 November still called the people count unpublished. Keep recordsAffected at 0.
Was the rest of the network reached?
The company says no. Only the provider application, for a limited time on 10 September.
That scope can still be enough. An app that holds patient identity and self-reported medical data is a census waiting to be counted, not a non-event.
Frequently asked questions
How many people were affected?
Unpublished. recordsAffected stays 0.
When did this happen?
10 September 2026. Sample letters dated 6 November.
Were Social Security numbers involved?
Not on the HIPAA Journal field list. The CA sample uses a mail-merge token.
Was this ransomware?
Not named. The letter describes unauthorised access to the provider application.
Network or app?
Provider application only, the company says. Other systems not reached.
Sourcing note: California AG sample letter dated 6 November 2026, HIPAA Journal 11 November field list.
Do not download alleged Enara Health dumps. This catalog does not link them. A later leak-site post is still an unverified brand until Enara Health names it.
Compare later mail with enarahealth.com. Enara Health will not ask for a card CVV or a one-time code through a new website to finish this investigation.
Do not merge this row with a clinic EHR ransomware row. They are separate catalog files even when they share a season or a vendor class.
If you did not receive a letter, you may still be in an unpublished state filing. Ask Enara Health in writing whether your identifier sits in the reached file.
US residents can place a free credit freeze at Equifax, Experian and TransUnion. Use the local freeze or watch process named in the notice if you live elsewhere.
Keep the paper letter if one arrives. A later amendment can add fields or a higher census. This catalog will move recordsAffected only when a named official source publishes a new figure. Do not treat a class-action advertisement as a census.
If two organisations share a similar name, read the company page before you enrol in monitoring. Wrong-firm sign-up pages are a common follow-on scam after a widely reported notice.
People who already froze credit last year should still read the new letter, because the field mix may differ this time. A freeze stays in place until you lift it.