Enara Health data breach: provider application platform accessed on September 10, 2026

What happened at Enara Health?

The letter describes a short intrusion into one application. Enara detected suspicious activity tied to its provider application on September 10, 2026. Its first steps were to change passwords, disable the accounts involved, notify federal law enforcement and bring in data security and privacy specialists. The investigation found no unauthorized activity elsewhere in its network or other systems. The letter does not say how the intruder got in.

Date	What happened	Source
September 10, 2026	Suspicious activity detected; unauthorized access that day	Notice letter, California AG record
November 6, 2026	Letter date	Notice letter

California's record gives September 10, 2026 as the date of the breach. The letters followed eight weeks later. The guide to how long organizations take to notify puts that against other letters in this log.

What information was taken?

The copy filed with California does not say. Where the list of data types belongs, it carries an unfilled field, "<<(data elements)>>". Each recipient's own letter should carry their list. The letter also does not say whether the people involved are patients, clinicians or applicants: it calls the system a "provider application platform" and stops there. Enara says there is no evidence so far that any of the information has been misused for identity theft or fraud. The guide to reading a California notice explains why filed samples carry fields like this one.

Is Enara Health offering credit monitoring?

No. The letter offers no monitoring or identity protection service. It points recipients to an "Additional Resources" page on free credit reports, fraud alerts and security freezes at the three national credit bureaus, and asks them to watch their account statements. The guide to credit-monitoring offers shows what other letters offer. Enara says it reset all passwords, reviewed accounts and permissions, and added technical safeguards, and that a deeper review of the application and its wider systems is under way.

Was my information in the Enara Health data breach?

A letter from Enara dated November 6, 2026 means its investigation matched you to the taken data. Its assistance line is (844) 971-8639, Monday to Friday, 8:00 a.m. to 5:30 p.m. Central Time, except U.S. holidays. The guide to healthcare provider breach notices compares what other health organizations have told patients.

How many people were affected by the Enara Health breach?

Texas's attorney general posted Enara Health's report on November 10, 2026, with 794 Texans affected. The Texas record lists names, medical information and dates of birth as the information involved, and notice by mail and on a website. No total for all states has been published.

What the notice leaves open

• How many people were affected in total: the letter and California's record give no count, and Texas counts its own residents only.
• Which data elements were taken.
• Whether the people involved are patients, providers or applicants.
• How the intruder got into the application.