OpenLoop Health data breach: telemedicine platform data removed in a two-day intrusion

What happened in the OpenLoop Health breach?

OpenLoop says the unauthorized access lasted from January 7 to January 8, 2026, and that it investigated with outside cybersecurity specialists, ended the access, coordinated with federal law enforcement and added controls.

Date	What the letter and the regulators' records say
January 7, 2026	OpenLoop learns of the access; breach date on California's record and Washington's list
January 8, 2026	The access ends
March 17, 2026	Date printed on the letter; report submitted to HHS; notice recorded by California
March 18, 2026	Posted on the Texas attorney general's list
March 27, 2026	Notice recorded by Washington
June 17, 2026	Last day to activate the IDX services

69 days passed between the discovery and the letter.

What information was involved?

The filed letter leaves the list of information as a blank field, and says the incident did not involve electronic health records, Social Security numbers or financial account information. Texas lists names, addresses, medical information and dates of birth. Washington lists names, full dates of birth and medical information, and also "Financial & Banking Information", which the letter says was not involved; the documents do not explain the difference.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	716,000
Texas attorney general	Texans	68,160
Washington attorney general	Washingtonians	19,980

Why did the 716,000 figure only appear in May?

OpenLoop reported the breach to HHS on March 17, 2026, but the listing with the 716,000 figure was only added to the HHS breach portal weeks later. The HIPAA Journal reported this on May 11, 2026. Until then the only public count was the Texas list's 68,160 Texans, posted on March 18. The letters themselves give no total.

Did hackers claim more than 716,000 records?

Yes, but the claim is unconfirmed. SecurityWeek reported on May 13, 2026 that OpenLoop had not named the attacker, and that a threat actor had reportedly claimed earlier in the year to have stolen the information of 1.6 million people. The HIPAA Journal cautioned that such claims may be exaggerated, may count the same records more than once, or may be made up. The regulator figure, 716,000, is the one this entry uses.

Figure	Who gives it	Status
716,000	HHS Office for Civil Rights breach portal	Reported by OpenLoop
68,160	Texas attorney general	Texans only, reported by OpenLoop
19,980	Washington attorney general	Washingtonians only, reported by OpenLoop
1.6 million	A threat actor, as reported by SecurityWeek and The HIPAA Journal	Unconfirmed claim

What is OpenLoop offering people who got a letter?

A one-year identity and credit monitoring service from IDX, with credit monitoring, fraud consultation and identity restoration.

Item	Detail from the letter
Provider	IDX
Length	One year
Enrollment	response.idx.us/OpenLoop, with the membership number on the letter
Deadline	June 17, 2026
Phone	1-844-539-9781

Why did I get a letter from OpenLoop Health?

You used a telemedicine service that runs on OpenLoop's platform. The letter says OpenLoop's platforms are made available through other companies, so the brand you know may not be OpenLoop. The guide to letters from companies you never dealt with explains the chain.

What the documents leave open

• How the third party got in. SecurityWeek describes OpenLoop as a Des Moines, Iowa company providing white-label digital health infrastructure, but neither report names the client brands.
• Which telemedicine brands' patients are affected.
• Why Washington lists financial and banking information.