Almeida Law Group is investigating a data breach at CallonDoc, Inc. The breach occurred on December 22nd, 2025. If you were affected, contact Almeida Law Group.
About CallonDoc, Inc.
CallonDoc, operating as Call-on-Doc, Inc., is a telehealth and telemedicine platform headquartered in Dallas, Texas. Founded in 2017 by Dr. TJ Oshun, the company connects patients with licensed medical providers for virtual visits covering urgent care, STD/STI testing, women’s and men’s health, mental health, primary care, and dermatology, and also offers online prescription refills, lab testing, and at-home test kits. Because CallonDoc provides healthcare services, it collects and stores protected health information, making the security of that information especially critical for affected patients.
What Happened?
CallonDoc, Inc. was listed in a California Attorney General sample breach notice filed on September 17th, 2026. According to the individual notice letter sent to affected patients, the company detected unauthorized access to its network on December 28th, 2025. The unauthorized access window ran from December 22nd, 2025 through January 3rd, 2026. On August 19th, 2026, CallonDoc determined that protected health information was potentially accessed or acquired during that period. Individual notification letters were dated September 18th, 2026—roughly nine months after the company first detected the intrusion and nearly thirteen months after the breach began. The specific data fields that may have been accessed appear to have been redacted from the publicly available notice; the company has not published a confirmed list of the exact data elements involved.
The timeline has drawn significant scrutiny. On January 22nd, 2026, cybersecurity firm UpGuard reported that a threat actor using the alias “iProfessor” allegedly listed a database purportedly containing approximately 1.14 million patient records for sale on a dark web forum for $5,000. The alleged listing claimed to include patient names, addresses, phone numbers, email addresses, and sensitive medical conditions. These are attacker-side allegations reported through dark web monitoring and have not been confirmed by CallonDoc. At least three federal class action lawsuits have been filed in the U.S. District Court for the Northern District of Texas: Garrigues v. Callondoc.com Inc, Case No. 3:26-cv-00233 (filed January 29th, 2026); Gutierrez-Clarke v. Call-on-Doc, Inc, Case No. 3:26-cv-00235 (filed January 29th, 2026); and Solar v. Callondoc.com d/b/a Call-on-Doc, Case No. 3:26-cv-00315 (filed February 5th, 2026). Law firm Chimicles Schwartz Kriner & Donaldson-Smith LLP has also publicly announced an investigation into potential class action claims. Separately, CallonDoc previously settled a $1.8 million class action (Lucas v. Call-On-Doc, Inc., Case No. 2026LA000403) alleging its website used third-party tracking pixels in violation of California’s Invasion of Privacy Act; that settlement received preliminary approval on May 19th, 2026 and is a distinct matter from this cybersecurity incident.
Key Facts at a Glance
- Company or Organization: CallonDoc, Inc. (Call-on-Doc, Inc.)
- Industry: Telehealth / Telemedicine
- Location: Dallas, Texas
- Incident type: Unauthorized access to network involving protected health information
- Date of breach: December 22nd, 2025
- Date breach discovered: December 28th, 2025
- Date of consumer notification: September 18th, 2026
- Prior breach: Separate $1.8 million CIPA tracking pixel class action settlement (preliminary approval May 19th, 2026); distinct from this incident
- Litigation status: Three federal class action lawsuits filed in the Northern District of Texas (January–February 2026); Chimicles Schwartz Kriner & Donaldson-Smith LLP investigation announced
- Source: California Attorney General sample breach notice; UpGuard dark web monitoring report; Chimicles investigation announcement; ClassAction.org – CIPA settlement
What Should You Do?
If you received a notice from CallonDoc, consider enrolling in any identity protection services offered in the letter within the stated deadline. Because protected health information was involved, carefully review your Explanation of Benefits statements and any medical records for services you did not receive or authorize. Place a fraud alert with one of the three major credit bureaus—Equifax, Experian, or TransUnion—which will then notify the others; a fraud alert is free and lasts one year. If you are more concerned, consider placing a free security freeze on your credit file at all three bureaus to prevent new accounts from being opened in your name. Request your free annual credit reports at AnnualCreditReport.com and review them carefully for unfamiliar accounts or inquiries. If you suspect misuse of your personal information, you can report it and get a recovery plan at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
