VirtaHealth
bd_0a26e18c6ccacb30 · schema v1 · pii pii-v1
Full breach record for VirtaHealth →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Lapsus$ on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Healthcare research
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Mar 29, 2026
Claim posted
—
Corroborated · see linked filings
This record's own dates cannot anchor compliance clocks; see the linked filings.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- HHS OCRbd_adcafdeb213f73552026-05-23 · +55dVerified
- California State AGbd_b2319c29454232032026-06-12 · +75dVerified by operator
- HHS OCRbd_4b9cd878952d35ce2026-06-30 · +93dVerified
- Massachusetts State AGbd_3be3b0fcdcde03002026-09-01 · +156dVerified
Show 1 more filing ↓Show fewer ↑up to 158d gap
- South Carolina State AGbd_7fff8c003537f5572026-09-03 · +158dCandidate
Filing propagation · 5 filings · 4 states
View merged incident ↗Pattern: first filing May 23 (CO), last Sep 3 (SC) — a 103-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
lapsus$
According to ransomware.live, Lapsus$ is an internationally composed data extortion group most active from mid-2021 through 2022, executing high-profile breaches against Microsoft, Nvidia, Samsung, Okta, and Uber by stealing source code and threatening leaks rather than encrypting files; several members — predominantly teenagers — were arrested in the UK.