VirtaHealth
bd_b2319c2945423203 · schema v1 · pii pii-v1
Full breach record for VirtaHealth →Virta Health Corp. notified the California AG of a security incident where unauthorized activity was identified on March 24, 2026, in a data repository separate from the production platform. The incident involved potential access to files between March 19 and March 22, 2026. Exposed data included names, Social Security numbers, dates of birth, and medical information (diagnoses, treatments, record numbers). Virta engaged external cybersecurity experts, notified law enforcement, and is offering 12 months of complimentary credit monitoring and fraud assistance to affected individuals. No indication of misuse was found.
J jump to incidentP pin to compareR raw source
Incident timeline
Mar 19, 2026
Begins
Mar 24, 2026
Discovered
Jun 12, 2026
Filed
vs. sector median
+2 wks slower
Linked disclosures
Why this link?Ransomware claims (1)
- Leak Sitelapsus$bd_0a26e18c6ccacb302026-03-29 · +75dCandidate
Regulatory filings (4) · sorted by filing gap
- HHS OCRbd_4b9cd878952d35ce2026-06-30 · +18dVerified
- HHS OCRbd_adcafdeb213f73552026-05-23 · +20dVerified
- Massachusetts State AGbd_3be3b0fcdcde03002026-09-01 · +81dVerified
- South Carolina State AGbd_7fff8c003537f5572026-09-03 · +83dCandidate
Filing propagation · 5 filings · 4 states
View merged incident ↗Pattern: first filing May 23 (CO), last Sep 3 (SC) — a 103-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.