Virta Health Corp. and Virta Medical, P.C. reported a security incident involving a data repository separate from their current production platform. The company disclosed the incident after an investigation, noting that certain files may have been accessed in May 2026, and began notifying affected individuals on May 23, 2026.
The breach affected approximately 14,636 individuals. Exposed data types include names, Social Security numbers, dates of birth, contact information, medical diagnosis and treatment information, medical record numbers, health insurance information, physician and facility information, dates of medical service, and other unique health identifiers. A complete state-by-state list of all impacted residents has not been identified, but the incident was reported to the California Attorney General. Officials have not yet disclosed the full number of individuals notified versus only the number affected, and any officially posted PDF breach letter beyond the substitute notice summary remains unclear.
Details about data breaches can emerge over time, and notifications to affected individuals may be delayed. More information may become available as investigations continue.