Virta Health Corp. and Virta Medical, PC
bd_3be3b0fcdcde0300 · schema v1 · pii pii-v2
Virta Health Corp. and Virta Medical, PC notified Massachusetts residents of a data security incident. On March 24, 2026, Virta identified unauthorized activity in a separate data repository. The investigation revealed that certain files were potentially accessed between March 19, 2026, and March 22, 2026. Exposed information included first and last name, potentially combined with other personal data elements. Virta secured the environment, engaged external cybersecurity experts, and notified law enforcement. Complimentary credit monitoring and fraud assistance services are being offered to affected individuals.
J jump to incidentP pin to compareR raw source
Incident timeline
Mar 19, 2026
Begins
Mar 24, 2026
Discovered
Sep 1, 2026
Filed
Linked disclosures
Why this link?Ransomware claims (1)
- Leak Sitelapsus$bd_0a26e18c6ccacb302026-03-29 · +156dCandidate
Regulatory filings (4) · sorted by filing gap
- South Carolina State AGbd_7fff8c003537f5572026-09-03 · +2dCandidate
- HHS OCRbd_4b9cd878952d35ce2026-06-30 · +63dVerified
- California State AGbd_b2319c29454232032026-06-12 · +81dVerified by operator
- HHS OCRbd_adcafdeb213f73552026-05-23 · +101dVerified
Filing propagation · 5 filings · 4 states
View merged incident ↗Pattern: first filing May 23 (CO), last Sep 3 (SC) — a 103-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.