zHealthEHR
bd_63ca79c9153b788c · schema v1 · pii pii-v1
Full breach record for zHealthEHR →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Kazu on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
zHealthEHR is a cloud-based electronic health record (EHR) and practice management platform built primarily for chiropractors and other wellness providers. It combines clinical documentation, appointment scheduling, patient intake, billing, payments, and automated reminders into a single system, helping small to mid-size practices streamline daily operations. The platform focuses on ease of use, customizable SOAP notes, and patient engagement tools, allowing providers to reduce administrative workload and run their clinics more efficiently through a subscription-based software model.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Jan 26, 2026
Claim posted
—
Corroborated · see linked filings
This record's own dates cannot anchor compliance clocks; see the linked filings.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- HHS OCRbd_f73668fb4abe49ff2026-07-29 · +184dVerified by operator
- California State AGbd_09565557447b8e652026-09-11 · +228dVerified
- Oregon State AGbd_1b9d27f3c07035af2026-09-11 · +228dVerified
- Washington State AGbd_739608865619b3f12026-09-11 · +228dVerified
Show 1 more filing ↓Show fewer ↑up to 232d gap
- Texas State AGbd_136b40de0e1091732026-09-15 · +232dVerified
Filing propagation · 5 filings · 4 states
View merged incident ↗Pattern: first filing Jul 29 (CA), last Sep 15 (TX) — a 48-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
kazu
According to ransomware.live, Kazu is an emerging ransomware group active since September 2025 that employs double-extortion tactics, targeting government, healthcare, and financial organizations primarily in Southeast Asia, the Middle East, and Latin America, with notable claimed breaches including Dubai's Ports, Customs and Free Zone Corporation with 1.94 TB exfiltrated.