Almeida Law Group is investigating a data breach at Virta Health. If you were affected, contact Almeida Law Group.
About Virta Health
Virta Health Corp. is a privately held digital health company headquartered in Denver, Colorado, founded in 2014. It provides virtual care for individuals with type 2 diabetes, prediabetes, and obesity through a telehealth-based, nutrition-first model that includes personalized nutrition programs, health coaching, and technology tools. The company works with approximately 550 employers, health plans, and government partners and has more than 700 employees. Because Virta Health and its clinical entity, Virta Medical PC, deliver medical care and collect patient health information, the data involved in this breach includes highly sensitive personal and medical records.
What Happened?
Virta Health was listed in an HHS Office for Civil Rights breach portal report submitted on June 30th, 2026. The incident is classified as a hacking/IT incident involving a network server, with 602 individuals listed under this particular filing as a Business Associate. A separate HHS filing under Virta Medical PC, the clinical arm of the same organization, reports 14,636 individuals affected — both filings relate to the same March 2026 incident.
On March 24th, 2026, Virta Health identified unauthorized activity in a data repository separate from its current production platform. The investigation confirmed that files were potentially accessed between March 19th, 2026 and March 22nd, 2026. The Lapsus$ threat group claimed responsibility for the attack and added Virta Health to its data leak site on March 23rd, 2026 — one day before the breach was internally detected — and stated its intent to publish the stolen data within six days. HackManac reported that approximately 1TB of data was exposed. Virta reported the breach to the California Attorney General starting May 23rd, 2026, and mailed notification letters to affected individuals on June 17th, 2026.
According to the breach notice filed with the California Attorney General, the compromised information includes first and last names, Social Security numbers, dates of birth, dates of medical service, medical diagnosis information, physician and medical facility information, medical condition and treatment information, medical record numbers, and other unique health identifiers.
A proposed class action lawsuit, Koenemann v. Virta Health Corporation, was filed in the U.S. District Court for the District of Colorado in April 2026, alleging the company failed to adequately safeguard patients’ personal and medical information and that the stolen data was exposed to the dark web. Multiple additional law firms have separately announced investigations or are accepting case intake on behalf of affected individuals. One third-party source references an earlier breach discovery date of April 28th, 2023, and a potential multi-year detection gap has been noted; however, the official California AG notice limits the confirmed access window to March 19th through March 22nd, 2026, and this discrepancy has not been resolved. Virta is offering 12 months of complimentary single-bureau credit monitoring through CyberScout.
Key Facts at a Glance
- Company or Organization: Virta Health (Business Associate filing); related filing under Virta Medical PC
- Industry: Healthcare / Telehealth / Digital Therapeutics
- Location: Denver, Colorado
- Incident type: Hacking/IT Incident — Network Server
- Date of breach: March 19th, 2026
- Date breach discovered: March 24th, 2026
- Date of consumer notification: June 17th, 2026
- Total persons affected: 602 (this HHS filing); 14,636 (separate Virta Medical PC HHS filing)
- Identity theft protection offered: 12 months of complimentary single-bureau credit monitoring through CyberScout
- Prior breach: Unresolved discrepancy — one third-party source references an April 28th, 2023 discovery date; official notice limits access to March 19th–22nd, 2026
- Litigation status: Koenemann v. Virta Health Corporation, proposed class action filed April 2026 in the U.S. District Court for the District of Colorado; multiple additional law firm investigations announced
- Source: HHS Office for Civil Rights breach portal report; HIPAA Journal; Virta Health official notice; Law360
What Should You Do?
If you received a notification letter from Virta Health, enroll in the offered 12 months of credit monitoring through CyberScout before the enrollment deadline stated in your notice. Regardless of whether you enroll, consider placing a fraud alert or credit freeze on your credit files with all three major bureaus — Equifax, Experian, and TransUnion. Review your credit reports for any accounts or charges you do not recognize; free reports are available at AnnualCreditReport.com. Because medical information was exposed, carefully review any Explanation of Benefits statements from your health insurer and check your medical records for services you did not receive. If you find signs of identity theft or fraud, report them at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
