Zenflow Medical Device Firm Investigated After Data Breach Exposes Sensitive Patient Information Zenflow, Inc., a South San Francisco-based medical device company specializing in minimally invasive treatments for benign prostatic hyperplasia (BPH), is under investigation following a data breach that may have exposed personally identifiable information (PII). The incident was disclosed to the Massachusetts Attorney General’s office on January 7, 2026. Founded in 2014, Zenflow develops the Zenflow Spring System, an investigational implant designed to treat urinary obstruction. Despite raising approximately $80 million in funding, the device remains in clinical trials and has not yet received FDA approval. The company employs fewer than 35 people. The breach potentially compromised sensitive data, including: - Full names - Social Security numbers Zenflow has notified affected individuals and is offering free credit monitoring and identity protection services through Cyberscout (a TransUnion company). Those impacted may also be eligible for compensation, with class action law firm Shamis & Gentile P.A. actively investigating potential legal claims related to privacy violations and identity theft risks. The incident highlights growing cybersecurity risks in the healthcare and medical device sectors, particularly for companies handling sensitive patient data during clinical trials.