Call-On-Doc Faces Alleged Data Breach with Unconfirmed Patient Exposure A threat actor claims to have breached Call-On-Doc, a telehealth provider, in early December, accessing what appears to be sensitive patient data. According to private communications with DataBreaches, the attacker found no evidence of encryption during the intrusion and alleged the company failed to detect the breach while it was active. The threat actor contacted Call-On-Doc on December 25, presenting proof of the breach and attempting to negotiate a payment to prevent data leaks or sales. However, after initial contact via an unofficial email, the company reportedly ceased communication. As of publication, Call-On-Doc has not confirmed the breach or issued any public notifications to affected patients, regulators, or state attorneys general. Under HIPAA, covered entities must report breaches within 60 days of discovery, while 19 states require notification within 30 days. The lack of response raises concerns about compliance, particularly given the potential involvement of patients across multiple states, which could prompt a multi-state regulatory investigation. DataBreaches reviewed a sample of 1,000 records from the alleged dataset, verifying that most patients still reside at the listed addresses, while others had lived there recently. The threat actor is also accepting escrow payments for the data a common tactic in legitimate cybercriminal sales further suggesting the breach may be real. No official confirmation has been provided by Call-On-Doc, leaving the full scope and impact of the incident unclear. Regulatory scrutiny is likely if the data is authenticated.