Goglia Nutrition, a provider of personalized nutrition and weight management services through its G-Plans platform, suffered a data breach originating from a cyberattack on FuturHealth, its third-party data hosting vendor. The incident, discovered in October 2025, involved unauthorized access by a threat actor who exfiltrated sensitive subscriber data, including names and medical information tied to G-Plans subscriptions. The breach—disclosed to the California Attorney General’s office—posed risks of identity theft and medical fraud for potentially thousands of affected individuals. While the exact number of victims remains undisclosed, FuturHealth initiated notifications via mail and established a dedicated call center for support. Both Goglia Nutrition and FuturHealth implemented enhanced security measures post-breach to mitigate future risks, though the incident underscored vulnerabilities in third-party data handling and the exposure of protected health information (PHI).

Goglia Nutrition LLC, a health and wellness company specializing in personalized nutrition plans, experienced a data breach via its third-party hosting provider, FuturHealth. An unauthorized actor accessed subscriber data, exposing highly sensitive personally identifiable information (PII) and protected health information (PHI). The compromised data included names, current/previous medical diagnoses, treatments, prescriptions, provider details, and health insurance information—all submitted by users as part of their subscription. The breach was discovered on or before October 16, 2024, with investigations concluding by October 13, 2025, and notifications sent to affected individuals shortly after. The incident was formally reported to the California Attorney General’s office on October 30, 2025. Victims face risks of identity theft, medical fraud, financial exploitation, and emotional distress, with legal firms actively pursuing class-action lawsuits for compensation covering out-of-pocket expenses, time spent mitigating harm, and damages for unauthorized exposure of sensitive medical records.