2026 OpenLoop Health — OCR: up to 716,000 PHI; Jan 7–8 network intrusion
Data compromised
Names, addresses, email addresses, dates of birth, and medical information (PHI). Company said Social Security numbers were not accessed or stolen.
Technical writeup
Verified — company notice to California AG (reported Mar 17, 2026) and HHS OCR breach portal listing (added after the CA report; HIPAA Journal May 11, 2026 coverage). Telehealth platform OpenLoop Health Inc. learned on January 7, 2026 that an unauthorized third party had gained access to some systems and copied files. Forensics found network access from January 7–8, 2026. Exfiltrated files included names, addresses, emails, dates of birth, and medical information; OpenLoop said Social Security numbers were not accessed. OCR lists up to 716,000 individuals with compromised PHI. Texas AG listed 68,160 Texas residents (published Mar 18, 2026). A forum actor “Stuckin2019” separately claimed ~1.6 million patients and posted samples; that actor count is not company-confirmed and is not used as recordsAffected. Databreaches.net reported the forum post was short-lived and the actor claimed payment/data deletion. Affected people notified by mail with complimentary credit monitoring.
Root cause
Unauthorized third party accessed OpenLoop Health network systems Jan 7–8, 2026 and copied files containing sensitive data (company CA notice / OCR listing)