Virta Health Corp. and Virta Medical, PC
bd_7fff8c003537f557 · schema v1 · pii pii-v2
Virta Health Corp. and Virta Medical, PC notified individuals that unauthorized activity was identified on March 24, 2026, in a data repository separate from their production platform. The incident involved potential access to files between March 19, 2026, and March 22, 2026. Exposed information included first and last name and other personal data elements. Virta Health secured the environment, engaged external cybersecurity experts, and notified law enforcement. Complimentary credit monitoring and fraud assistance are being offered.
J jump to incidentP pin to compareR raw source
Incident timeline
Mar 19, 2026
Begins
Mar 24, 2026
Discovered
Sep 3, 2026
Filed
vs. sector median
+14 wks slower
Linked disclosures
Why this link?Ransomware claims (1)
- Leak Sitelapsus$bd_0a26e18c6ccacb302026-03-29 · +158dCandidate
Regulatory filings (4) · sorted by filing gap
- Massachusetts State AGbd_3be3b0fcdcde03002026-09-01 · +2dVerified
- HHS OCRbd_4b9cd878952d35ce2026-06-30 · +65dVerified
- California State AGbd_b2319c29454232032026-06-12 · +83dVerified by operator
- HHS OCRbd_adcafdeb213f73552026-05-23 · +103dVerified
Filing propagation · 5 filings · 4 states
View merged incident ↗Pattern: first filing May 23 (CO), last Sep 3 (SC) — a 103-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.