OpenLoop Health Breach Exposes 716,000 Patient Records Across 120 Healthcare Organizations A recently confirmed breach at OpenLoop Health compromised the personal and medical data of over 716,000 patients across 120 healthcare providers. The incident, stemming from a single unauthorized session lasting less than 24 hours, exposed names, addresses, dates of birth, and medical information tied to multiple telehealth and healthcare brands relying on OpenLoop’s infrastructure. The breach underscores a growing vulnerability in healthcare security: patient data no longer resides solely within provider-owned systems but flows through third-party platforms, telehealth services, scheduling tools, and analytics systems. When shared infrastructure is compromised, a single breach can impact dozens of downstream organizations even those without direct system intrusions. Most affected patients likely never interacted with OpenLoop directly, highlighting the risks of "invisible" healthcare infrastructure. Modern digital care relies on backend platforms that aggregate sensitive data from multiple providers, creating concentrated risk. While healthcare organizations invest in securing their own systems, compliance programs often overlook how patient data is stored, segmented, and accessed once it enters a vendor’s multi-tenant environment. Multi-tenant platforms, where data from different organizations is aggregated into shared storage and analytics systems, frequently lack consistent classification and access controls. This can leave large volumes of protected health information (PHI) broadly accessible, increasing exposure during a breach. The challenge extends beyond whether vendors have security controls organizations must understand how those controls apply to their specific data. To mitigate such risks, healthcare providers should prioritize continuous discovery and classification of PHI in shared environments, ensuring proper segmentation. Identity and access analysis is critical, as service accounts, APIs, and integrations can expand over time, leaving outdated permissions in place. Data lineage tracking where PHI originates, moves, and is stored also helps organizations quickly scope breaches and meet notification obligations. The OpenLoop breach reveals gaps in third-party data governance. Healthcare organizations must now map where regulated data resides across vendors, verify how it is isolated in shared environments, and review internal aggregation points like data lakes and warehouses. Incident response plans must also account for third-party exposures, as legal and reputational consequences can extend beyond direct system compromises. As healthcare data increasingly flows across interconnected platforms, security programs must evolve beyond internal systems. Continuous visibility into data location, access patterns, and vendor governance is essential to managing risk in an ecosystem where a single breach can have far-reaching consequences.

OpenLoop Faces Class-Action Lawsuit Over January Cyberattack Exposing 1.6 Million Patients’ Data Telehealth infrastructure provider OpenLoop is confronting a potential class-action lawsuit following a January cyberattack that may have compromised the sensitive health information of approximately 1.6 million individuals. The breach highlights growing vulnerabilities in digital health platforms and raises concerns about the security of patient data in an increasingly interconnected healthcare ecosystem. The incident underscores the broader risks of cybersecurity failures in the telehealth sector, where rapid adoption has outpaced robust safeguards. While details of the attack remain limited, the exposure of protected health information (PHI) could have significant legal, financial, and reputational consequences for OpenLoop and its partners. The fallout may also influence future dealmaking in digital health, as stakeholders prioritize security in vendor evaluations. The lawsuit, if certified, would represent one of the largest legal challenges tied to a telehealth-related breach, reflecting heightened scrutiny over data protection in the industry. The case serves as a reminder of the high stakes for companies handling sensitive medical records amid rising cyber threats.