Hackers stole the personal information of 716,000 individuals during a January 2026 intrusion at telehealth platform OpenLoop Health.
The incident was initially disclosed to the relevant authorities in March, but the number of impacted individuals was added to the US Department of Health and Human Services’ breach portal only this week.
According to notification letters OpenLoop Health filed with the Attorney General’s Offices in California and Texas, the intrusion was discovered on January 7.
“An unauthorized third party had gained access to certain OpenLoop systems and removed certain information,” the notification reads.
The hackers, it said, had access to its systems between January 7 and January 8, and stole personal information such as names, addresses, email addresses, birth dates, and medical data.
“This incident did not involve access to your electronic health record, Social Security number, or financial account information,” the notification letter reads.
The company said it immediately terminated the unauthorized access and launched an investigation into the matter with assistance from external cybersecurity specialists. It also improved its security controls and coordinated with law enforcement.
OpenLoop Health said it was not aware of any misuse of the stolen personal information, but urged the affected individuals to remain vigilant for fraud and identity theft. The company also provided them with one year of free identity and credit monitoring services.
The telehealth platform has not shared information on the threat actor responsible for the attack, but a threat actor reportedly claimed the attack earlier this year, saying they stole the information of 1.6 million individuals.
Headquartered in Des Moines, Iowa, OpenLoop provides white-label digital health infrastructure for healthcare and consumer organizations looking to provide virtual care.
Related: Skoda Data Breach Hits Online Shop Customers
Related: Data Breaches at Healthcare Organizations in Illinois and Texas Affect 600,000
