Virta Health Corp. and Virta Medical, PC notified the Washington State Attorney General in September 2026 of a data breach involving patient health information. The exact number of affected individuals hasn’t been disclosed. If you’ve used Virta’s services, watch for a notification letter, monitor your credit and medical statements closely, and consider consulting a data breach attorney about your options.
| Company | Virta Health Corp. and Virta Medical, PC |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Full Names, Health-Related Information, Patient Account or Treatment Details, Contact Information |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unspecified/Unauthorized Access |
| Regulators Notified | California Attorney General, Washington State Attorney General |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Virta Health Corp. Data Breach?
Virta Health Corp. and Virta Medical, PC recently disclosed a data breach that compromised patient information. The companies filed formal notification with the Washington State Attorney General in September 2026. This filing confirms that unauthorized parties gained access to sensitive data tied to patients who used Virta’s healthcare services.
As of now, the exact discovery date of the breach has not been publicly disclosed. However, the notification confirms that Virta Health Corp. identified the incident and moved to notify regulators and affected individuals. Details about the specific attack method used by the intruders remain limited in the public filing.
Because Virta Health Corp. operates in the healthcare space, this breach falls under scrutiny from both state regulators and federal health privacy rules. As a result, the company likely engaged forensic investigators to determine the scope of the intrusion. Investigations of this kind typically aim to confirm what data was accessed, how the attacker got in, and whether the exposure has been fully contained.
Virta Health Corp. has not released a detailed public account of the breach timeline beyond the notification filings. Nonetheless, the fact that formal notices went to attorneys general in multiple states suggests the company completed at least a preliminary assessment. This assessment presumably confirmed that personal data was accessed without authorization.
Who was affected?
The breach appears to affect patients who received care or services through Virta Health Corp. and Virta Medical, PC. Because Virta provides remote healthcare services, including chronic disease management programs, those affected are likely patients enrolled in these programs across the United States.
The exact number of individuals affected by this breach has not been publicly disclosed. In addition, it remains unclear whether employees, in addition to patients, had their information exposed. Given the healthcare nature of Virta’s business, the population affected could include people managing sensitive health conditions, which raises the stakes for privacy protection.
Because Virta Health Corp. serves patients nationwide through telehealth, the geographic reach of this breach could be broad. Meanwhile, there is no indication in the current filings that minors were specifically targeted or included among the affected individuals. Still, anyone who used Virta’s services should consider themselves potentially affected until more information becomes available.
What Information Was Potentially Exposed?
The notification filed with regulators indicates that patient information was involved in this breach. While the full list of exposed data categories has not been detailed publicly in the source filing, incidents involving healthcare companies commonly involve a combination of personal and medical information.
- Full names
- Health-related information
- Patient account or treatment details
- Contact information such as addresses or phone numbers
- Potentially other identifying information tied to healthcare records
Exposure of health information carries serious consequences. For example, medical identity theft can occur when criminals use stolen health data to obtain treatment, prescriptions, or medical equipment under someone else’s name. This type of fraud can corrupt medical records, which may lead to incorrect treatment decisions down the line.
In addition, exposed personal information can fuel phishing attempts and scams. Because attackers often combine stolen health data with other details, victims may face targeted scams that appear more convincing. As a result, affected individuals should stay alert to unexpected calls, emails, or texts referencing their healthcare provider or treatment history.
What is the company doing?
Virta Health Corp. responded to the breach by notifying regulators, including the Washington State Attorney General, as required under state law. This step shows the company acknowledged the incident and began the formal disclosure process required for breaches involving personal data.
Virta Health Corp. also filed a notification with the California Attorney General. Filing with multiple state regulators suggests the breach affected residents across different states, prompting compliance with each jurisdiction’s specific notification laws.
Beyond regulatory filings, companies in this situation typically work to secure affected systems and prevent further unauthorized access. While specific remediation steps taken by Virta Health Corp. have not been detailed publicly, it’s common for organizations facing breaches like this to review network security, reset credentials, and monitor for suspicious activity going forward.
Affected individuals should watch for a formal notification letter from Virta Health Corp. This letter typically outlines specific steps the company recommends and any protective services being offered, such as credit monitoring or identity protection enrollment.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should request and review their credit reports regularly. This helps catch any suspicious new accounts or inquiries that could signal identity theft.
You can get free credit reports from each of the three major credit bureaus. Because fraud can take time to surface, checking your reports periodically over the coming months is a smart precaution.
Consider a Fraud Alert or Credit Freeze
If your personal information was included in this breach, placing a fraud alert on your credit file adds an extra layer of protection. This makes it harder for someone to open new credit accounts in your name without additional verification.
A credit freeze goes a step further by restricting access to your credit file entirely. Although a freeze can add extra steps when you apply for credit yourself, it significantly reduces the risk that a criminal can use your data successfully.
Be Alert for Healthcare-Related Fraud
Because this breach involves a healthcare provider, affected individuals should closely review any medical bills, insurance statements, or explanation-of-benefits notices. Unfamiliar charges or services you didn’t receive could indicate medical identity theft.
If you notice anything unusual, contact your insurance provider and Virta Health Corp. directly. Reporting discrepancies quickly can help limit further damage and correct your medical records before errors compound.
Watch for Phishing and Scam Attempts
Following any healthcare data breach, scammers often send emails or texts pretending to be from the affected company. These messages may ask you to click links or provide personal information under false pretenses.
Therefore, avoid clicking on unexpected links and verify any communication directly with Virta Health Corp. through official contact channels. Legitimate companies will never ask for sensitive information like passwords through unsolicited messages.
Consult a Data Breach Attorney
Given the sensitive nature of health information involved, affected individuals may want to speak with a data breach attorney. An attorney can help you understand your legal rights and whether you qualify for compensation.
Many attorneys offer free consultations for breach victims. This means you can explore your options at no upfront cost while getting clarity on potential next steps, including participation in a class action if one develops.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
Official data breach notification from California Attorney General
Official data breach notification report (PDF) from Washington State Attorney General