ZenPatient 2025 Data Breach

The primary evidence is ZenPatient's consumer notice dated July 17, 2026, published through the California Attorney General record. On the company's behalf, the letter directly states discovery of suspicious activity, the unauthorized access or copying period, comprehensive data review, notification process, federal law-enforcement notice, and identity-protection services offered.

A Texas regulatory disclosure supports the 1,179-resident subset and incident data categories. Claim Depot connects the California and Texas records and independently summarizes the dates and scope involving names, addresses, birth dates, and medical information. The sources align on the organization, access period, July 1 review result, and July 17 notification start.

ZenPatient observed suspicious activity in its network around February 27. An investigation with outside cybersecurity and data-privacy specialists determined that one or more unauthorized actors accessed or copied certain ZenPatient data from December 5 through February 12. The official letter uses both alternatives and does not say all data was definitively copied.

The public material does not disclose the initial entry method, actor identity, malware, ransom demand, or why access ended before discovery. Unverified person counts, data fields, and threat-actor claims are not treated as part of the public incident scope.

The incident summary based on regulatory records lists names, addresses, and dates of birth among affected personal fields. The official sample letter displays the recipient's name as a fixed element and other fields in a person-specific variable section. The same data combination therefore should not be assumed for every individual.

Names, addresses, and birth dates may enable targeted phishing, fraudulent account verification, and social engineering. Social Security numbers, driver's licenses, and other documents mentioned in the protection appendix are general examples that may be required for a credit freeze, not confirmed incident fields.

Medical information was confirmed within the possible scope of the incident involving a digital-health and telehealth provider. Medical data may link a person to a healthcare relationship and creates risks of medical-identity misuse, targeted scams, or sensitive inferences. Public sources do not say every person's file contained medical information.

The source does not separately identify a diagnosis, treatment, prescription, laboratory result, telehealth encounter, medical-record number, health-insurance information, physician name, or service date. The medical-information category should therefore be read at the level of specificity published by the sources. Recipients should review health portals and provider statements for unfamiliar services or changes.

Texas Attorney General record BR-0005188 reports 15,750 affected people nationwide, including 1,179 Texas residents. The approximately 52 Rhode Island residents identified in the consumer letter are a subset of the nationwide figure and have not been added on top of it.

ZenPatient said that, as of the letter date, it had no evidence of actual or attempted misuse of anyone's information resulting from the event. That time-bound finding does not guarantee that future misuse will not occur. Given possible copying and medical-data scope, recipients should continue monitoring unusual activity in financial, credit, and healthcare accounts.

The company secured its environment, conducted a comprehensive investigation and data review with outside specialists, notified federal law enforcement and relevant regulators, reviewed existing policies, and implemented additional cybersecurity measures. Eligible people were offered 12 months of complimentary Experian IdentityWorks credit monitoring and identity-theft protection, with enrollment due by October 31, 2026.

Recipients should enroll only with the code in their letter and review credit reports and healthcare-account activity for unfamiliar transactions, inquiries, or services. A help line at 833-931-4343 is available from 8:00 a.m. to 8:00 p.m. Central on weekdays. Health information, passwords, or verification codes should not be shared in unexpected messages claiming to represent ZenPatient.