2026 zHealth — unauthorized network copy Jan 20–21; 118,563 people (PHI/insurance)
Data compromised
Varies by individual; may include name, medical information, and/or health insurance information. Oregon AG informed of 118,563 affected; CA/TX notices filed; 12 months credit monitoring offered.
Technical writeup
Verified zHealth notice — September 10, 2026 (notifications began ~Sep 11). Became aware ~June 15 that information may have been copied; forensics showed unauthorized activity January 20–21, 2026; data review finished September 3. Potentially impacted: names, medical information, and/or health insurance information (varies). Oregon AG reported 118,563 individuals. recordsAffected 118563; companyConfirmed true.
Root cause
Unauthorized third party copied information from zHealth network environment (activity Jan 20–21, 2026; discovered ~Jun 15)