zHealth, a US electronic health record and practice-management vendor, confirmed that an unauthorized third party copied information from its network during January 20–21, 2026—yet the company only became aware something was wrong around June 15 and finished reviewing what was taken by September 3. Notifications began about September 10–11, 2026. Oregon’s attorney general was told 118,563 people were affected; California and Texas filings also appeared. Offered remediation includes twelve months of credit monitoring, but the exposed fields vary by person: names plus medical information and/or health insurance information.
Canonical page: BreachHistory — zHealth network breach. Primary sources: zHealth notice, California AG report, and HIPAA Journal summary.
Timeline — long discovery lag
January 20–21, 2026: Forensics later tied unauthorized copying activity to this window. Patients and clinics did not receive letters in January; the activity was not publicly disclosed then.
~June 15, 2026: zHealth became aware that information may have been copied. That is roughly five months after the copying window—typical of attacker dwell time or delayed detection tooling, though zHealth has not published which detection mechanism fired.
September 3, 2026: Data review completed enough to describe categories at a high level.
September 10, 2026 (reportedAt in catalog): Formal notice timing anchor; mailings began around September 11 per trade summaries.
Oregon AG count: 118,563 individuals—a regulator-facing number readers will see in “zHealth breach 118563” searches.
What we know vs what we do not
Confirmed: Unauthorized third party copied data from zHealth’s network environment; activity dates January 20–21, 2026; awareness ~June 15; review finished September 3; up to 118,563 people in Oregon AG reporting; fields may include name, medical information, and/or health insurance information depending on individual; twelve months credit monitoring offered; CA/TX notices filed.
Not confirmed in public notices summarized here: Exact clinic list, full diagnosis code inventory, whether ransomware was involved, attacker name, HHS OCR posting content at indexing, and whether data appeared on leak sites.
This is a verified zHealth data breach with HIPAA-era stakes—not an unverified forum sale claim.
What zHealth is
zHealth EHR serves ambulatory practices—think specialty clinics and small hospital affiliates using a shared cloud or hosted platform for charts, scheduling, and billing hooks. When the vendor network is copied, impact spans many small patient populations rather than one hospital logo.
That structure explains the six-figure headcount with a vendor name some patients have never heard: you may know your dermatologist, not the SaaS behind the portal.
What was exposed
zHealth’s notice language is intentionally variable: each person may have name plus medical information and/or health insurance information. Medical information under HIPAA can include diagnoses, medications, lab results, visit notes, and identifiers tied to care. Insurance information can include payer names, policy numbers, and billing metadata useful for fraud.
There is no public “everyone lost SSN” line in the catalog record. Do not assume Social Security numbers unless your letter says so.
What was not stated
zHealth’s summarized disclosure does not say imaging DICOM files, full credit card numbers, or portal passwords were taken. Absence of mention is not proof of absence—wait for your notification letter for field-level detail.
Who is at risk — by audience
Patients of zHealth-connected clinics
If your provider uses zHealth EHR and you receive official mail or email from the vendor or clinic, treat the letter as authoritative for your data mix. Medical identity theft uses insurance info to file fake claims; clinical info enables spear-phishing (“about your recent lab at Dr. X”).
Parents and dependents
Pediatric and family practices on the platform may mean minors’ PHI is in scope. Guardians should watch Explanation of Benefits oddities and clinic portal messages.
Clinic staff
Employees are not the primary regulated notification cohort here, but fraudsters may call front desks pretending to be “zHealth breach support” to harvest admin credentials—separate from patient PHI copied in January.
People searching “was I affected?”
Without a public lookup tool cited in sources, wait for direct notice or call your clinic using the phone number on your billing statement—not a number from SMS.
HIPAA and state AG context
118,563 in Oregon AG filing signals a large breach under state reporting rules and likely HHS OCR interest, though OCR’s public wall may update on its own schedule. California’s SB 24 report link provides another paper trail for researchers tracing zHealth EHR breach 2026 paperwork.
Credit monitoring for twelve months helps with financial identity theft but does not fully address medical misuse. Patients should also monitor insurance statements and clinic accounts.
January theft, June discovery — why the gap matters
Five months between copy and awareness means attackers had spring and early summer with potential access to whatever they exfiltrated in January—time to sell batches, test fraud, or sit on insurance numbers. zHealth has not described encryption-at-rest status or whether data was encrypted in transit only. Readers should not invent “encrypted so safe” narratives.
For clinics, the lesson is vendor SOC visibility: ask zHealth what changed detection-wise after June 15 and whether other tenants saw indicators earlier.
How medical phishing uses this incident
Expect:
- Email claiming “Your zHealth lab results blocked due to breach — log in here.”
- SMS with a link to “claim breach settlement credit.”
- Calls pretending to be clinic billing, citing real breach dates (Jan 20–21) to sound legitimate.
- Fake credit monitoring enrollments that steal SSN at enrollment time.
Real monitoring enrollment comes from instructions in your official letter, with vendor names zHealth names—not random Android apps.
Action items
- Read your mailed or emailed notice carefully for which of the three categories (name, medical, insurance) apply to you.
- Enroll in offered credit monitoring if you want financial bureau alerts—use only URLs from the letter.
- Review health insurance EOBs for services you did not receive; report discrepancies to your payer.
- Place a fraud alert or freeze if your letter mentions financial identifiers or if you already have identity theft concerns.
- Do not give portal passwords or MFA codes to anyone who calls about the breach.
- Ask your clinic how they will handle portal messaging authenticity during the notification wave.
- Keep copies of notices for tax or legal records if medical fraud expenses arise.
- If you receive nothing but believe you were a zHealth patient in 2026, call your provider’s office—not a number from search ads.
Practice management sector context
EHR and practice-management vendors remain high-value targets because they aggregate PHI across customers. A single network copy event bypasses the need to hack fifty separate clinic firewalls. 2026 has seen other large healthcare vendor incidents; zHealth’s 118,563 figure places it in the mid-tier by count but maximum sensitivity by data type.
Insurance fraud mechanics (plain English)
Stolen insurance information lets criminals bill payers for fictional visits. Victims discover it when collections or EOBs show unknown providers. Medical record data helps attackers answer knowledge-based authentication questions on payer portals. That is why “credit monitoring only” is necessary but not sufficient.
What clinics should do
Communicate consistently with zHealth’s template, staff phones on fraud attempts, and verify any vendor request for mass patient outreach lists. Rotate admin credentials to zHealth admin consoles. Ask for tenant-specific forensic summary if not already provided under BAAs.
Regulator and patient communication
Oregon, California, and Texas filings give journalists structured data; patients should still rely on zHealth’s Notice of Data Event for enrollment steps. HIPAA Journal’s writeup helps security pros cross-check dates but is not a substitute for individual letters.
Keywords and search intent
Searches mix “zHealth data breach,” “zHealth EHR 118563,” “medical information exposed January 2026,” and “health insurance information stolen.” This piece matches those phrases to verified dates and counts only.
Canonical record and sources
2026 zHealth unauthorized network copy
- zHealth — Notice of Data Event
- California Attorney General — breach report
- HIPAA Journal — timeline recap
Related BreachHistory reading: Aesto Health’s large PHI exposure and other healthcare vendor incidents in the catalog.
Patient portal hygiene
After breaches, patients often reset passwords on the wrong sites, reusing weak passwords. If your clinic portal uses zHealth branding, change password only on the official URL you bookmarked before the breach—not from email links. Enable MFA if the clinic offers it.
Children and elderly relatives
Check whether notices went to household addresses for dependents. Caregivers should monitor mail for letters addressed to minors. Elderly patients may need help distinguishing real monitoring invitations from scams—use in-person or known phone callbacks.
Business associate angle
Clinics signed BAAs with zHealth expecting reasonable safeguards. The January event will trigger insurer and legal review. Patients care about outcomes: free monitoring, clear data categories, and fast answers on whether January labs about sensitive conditions leaked.
What OCR may do
Large PHI incidents often draw HHS OCR investigation, but timing is unpredictable. Lack of OCR headline at indexing does not minimize 118,563 notified individuals in Oregon’s filing.
Closing facts
January 20–21 copying. June awareness. September notifications. 118,563 people in Oregon AG count. Names, medical info, and/or insurance info vary by person. Twelve months monitoring offered. That is the verified zHealth breach 2026—no invented ransomware group, no fabricated SSN census.
Extended timeline for compliance officers
Map your internal clock: when did zHealth first notify you as a covered entity customer? BAAs often require sub-vendor notice within days of discovery—June 15 awareness implies clinics should have learned before September public mail. If you are a compliance officer learning dates from blogs instead of your vendor, escalate relationship management today.
Research notes on similar EHR incidents
Vendor-centric copies differ from clinic phishing: one network egress, many specialties. Risk assessments should score SaaS concentration accordingly. If half your providers share one EHR, one breach letter day can flood call centers—prepare scripted responses that match zHealth official language.
Financial identity vs clinical identity
Credit freezes do not stop medical billing fraud. Pair bureau freezes with payer portal alerts and annual insurance summary reviews. If your notice lists only medical and insurance fields without financial account numbers, still consider fraud alerts because insurance IDs are monetizable.
Documentation for employers
Self-insured employers may see downstream fraud in corporate health plans when employee PHI was in zHealth-hosted charts. HR should coordinate with benefits brokers without publishing employee names in company-wide email—use general guidance plus private letter matching.
zHealth patients deserve clarity without panic: a confirmed copy event with regulatory filings, not rumor. Watch official channels, enroll monitoring if useful, and treat breach-themed outreach as hostile until verified.
Oregon 118,563 — how to read the number
State AG counts often include residents of that state whose providers use the vendor. Multi-state clinics can produce overlapping filings; 118,563 is not automatically “total US patients” unless other states publish identical totals. California’s SB 24 report adds another data point for researchers comparing census methodology.
January vs June — patient communication gap
Patients who visited zHealth-backed clinics between January and June without knowing of unauthorized copying should ask those clinics whether late discovery affects medical record integrity—not just identity theft. zHealth has not publicly described alteration of records; copying implies confidentiality breach first.
HHS and state attorney general coordination
Large healthcare vendor incidents typically involve multiple regulators. Oregon’s figure may appear in AG consumer alerts before OCR posts a wall entry. Patients searching HIPAA breach wall should also read zHealth’s own notice page for enrollment mechanics.
Specialty clinic examples (illustrative, not confirmed victims)
zHealth EHR users are often orthopedics, pain management, or multi-specialty groups—not necessarily hospital inpatients. If your only interaction was a 2025 telehealth visit with a small practice, you could still be in scope if records lived on zHealth infrastructure pre-June 2025 cutoff mentioned in vendor breach patterns elsewhere—follow your letter, not guesswork about clinic size.
Medical ID theft — first 30 days
Week one: read notice, enroll monitoring if desired, pull one credit report. Week two: call payer fraud line with policy number handy. Week three: ask clinic for list of data elements they submitted to zHealth about you. Week four: revisit insurance summaries for surprise claims. This cadence does not replace legal advice but beats passive waiting.
Texas filing and multi-state patients
Catalog references Texas notices alongside California and Oregon. If you received care in multiple states, your letter may cite one regulator’s timeline while another state’s AG publishes a parallel PDF—compare dates rather than assuming conflicting facts.
Clinic call center surge
Small practices using zHealth may be flooded with patient calls while staff learn vendor talking points. When calling your doctor, ask whether they have a zHealth incident FAQ; avoid sharing SSN over the phone to unsolicited callers pretending to be the clinic verifying breach status.
Law enforcement and dark web
zHealth’s public notice chain at indexing does not describe ransomware publication. Absence of leak-site headlines does not shrink HIPAA obligations for 118,563 Oregon-reported individuals—notification stands on confirmed copying, not on criminal bragging.
Employer-sponsored plan members
If your employer health plan routed claims through a zHealth-connected clinic, HR may issue separate guidance from the vendor letter. Compare both before calling help desks—scammers exploit dual messaging.
Archived records before January 2026
Unauthorized activity dates to January 20–21, 2026. Older charts might still be in the environment but copying window is what zHealth forensics tied to the event—your letter remains the source for whether your record was accessed.
If no letter arrives by late September 2026 but you used a zHealth-hosted portal this year, call the clinic once using the number printed on your last visit summary—not a portal link from email.