Colorado Health Tech Firm Faces Class Action Over Patient Data Breach A proposed class action lawsuit has been filed in federal court against Virta Health Corporation, a Colorado-based digital health company specializing in Type 2 diabetes reversal programs. The suit alleges the company failed to adequately safeguard patients’ personal and medical information, exposing sensitive data to potential misuse. The legal action, Koenemann v. Virta Health Corporation, highlights growing concerns over data security in digital health platforms, particularly those handling highly confidential health records. While the exact scope of the breach and the number of affected individuals remain undisclosed, the case underscores the legal and reputational risks for healthcare providers and tech firms managing patient data. No further details on the timeline or specific vulnerabilities exploited have been released. The outcome of the lawsuit could set precedents for data protection standards in the telehealth and digital therapeutics sectors.

Virta Medical PC Data Breach Exposes Sensitive Patient Information On March 24, 2026, Virta Health a digital health company specializing in virtual care for type 2 diabetes and metabolic conditions detected unauthorized access to a data repository separate from its primary production platform. The breach occurred between March 19 and March 22, 2026, when an unauthorized third party potentially accessed sensitive files. Virta Medical PC, a Georgia-registered clinic affiliated with Virta Health, operates as a Medicare-enrolled telehealth provider serving patients across multiple states. Following the incident, the company secured its systems, engaged cybersecurity experts, and notified law enforcement. The exposed data includes a wide range of personally identifiable and health-related information, such as: - Social Security numbers and Individual Tax Identification numbers - Medical diagnoses, treatment details, and clinical records - Health insurance information and medical record numbers - Dates of birth, contact details, and physician/facility information Shamis & Gentile P.A., a law firm specializing in data breach class actions, is investigating potential legal claims for affected individuals. Those impacted may be eligible for compensation due to the exposure of their sensitive information.

Virta Health Discloses Data Breach After Nearly Three-Year Undetected Intrusion San Francisco-based digital health company Virta Health, which specializes in reversing type 2 diabetes through personalized nutrition and remote care, recently confirmed a data breach involving unauthorized access to a non-production data repository. The incident was first detected on March 24, 2026, though the breach itself occurred on or around April 10, 2023, meaning the intrusion may have gone unnoticed for nearly three years. The discovery followed a March 23, 2026, claim by the threat actor Lapsus-Group, which posted on a public forum alleging it had obtained and planned to leak Virta Health data within six days. While Virta Health’s official notice did not reference the group, the company acknowledged unauthorized activity in a separate data repository one isolated from its primary production systems. The investigation confirmed that certain files within the repository were potentially accessed, though the company found no evidence of data misuse. The exposed data may have included personal information, though Virta Health did not specify the types of details compromised in its public notice. The company stated that while forensic analysis could not definitively rule out unauthorized access, there were no signs of subsequent exploitation. In response, Virta Health began mailing notification letters to affected individuals with available contact information, while those without recorded addresses were informed via a substitute notice on the company’s website. A dedicated assistance line (833-502-8832) and email ([email protected]) were established for inquiries, operating Monday through Friday during business hours. The company did not offer free credit monitoring or identity protection services but provided state-specific guidance for residents in California, New York, Massachusetts, Maryland, North Carolina, Oregon, Texas, and other jurisdictions, directing them to their respective attorneys general and consumer protection agencies for further support. Virta Health emphasized its commitment to data privacy but did not disclose additional details about the breach’s scope or the number of individuals affected.