What happened in the ZenPatient data breach?

ZenPatient, Inc. recently announced a data breach involving unauthorized access to information stored within its network. According to the company’s sample California notification letter, ZenPatient identified suspicious network activity on or around February 27, 2026. The company then engaged third-party cybersecurity and data-privacy specialists to investigate the incident and determine whether sensitive information had been affected.

The investigation concluded that one or more unauthorized actors accessed or copied certain ZenPatient data sometime between December 5, 2025, and February 12, 2026. ZenPatient has not publicly explained how the unauthorized access occurred. In particular, the notification does not identify the initial point of entry, the security vulnerability involved, or whether the incident resulted from phishing, compromised credentials, malware, or another method. Accordingly, the publicly available information does not establish the breach’s underlying cause.

After investigating the network activity, ZenPatient conducted a detailed review of the affected files to determine what information they contained and which individuals were connected to that information. The company completed this review on or about July 1, 2026. It then worked to locate mailing addresses for potentially affected individuals and prepared notification letters.

The sample notice confirms that affected information included individuals’ names. However, it uses a customizable placeholder for the additional data elements involved, meaning the precise information may differ among recipients. The public sample therefore does not establish every category of personal information exposed in the ZenPatient data breach. ZenPatient also has not publicly disclosed the total number of affected individuals. The notice states that approximately 52 Rhode Island residents may have been affected, but that figure does not represent the incident’s nationwide total.

ZenPatient’s notification letters were dated July 17, 2026, and the incident was reported to the California Attorney General on the same date. The company said it was not aware of any actual or attempted misuse of information associated with the event as of the date of the notice. That statement describes what ZenPatient knew at that time and does not eliminate the possibility of future misuse.

In response to the ZenPatient data breach, the company reported securing its environment, reviewing its existing security policies, implementing additional cybersecurity protections, and notifying federal law enforcement and appropriate regulators. ZenPatient also stated that law enforcement did not delay the distribution of the notices.

ZenPatient is offering affected individuals 12 months of complimentary Experian IdentityWorks credit monitoring and identity-theft protection services. Available benefits include Experian credit-file monitoring, identity-restoration assistance, continued restoration support after the membership expires, and up to $1 million in identity-theft insurance, subject to applicable policy terms and limitations. According to the sample notice, eligible individuals must enroll by October 31, 2026. The company also advised recipients to review their financial accounts and credit reports for suspicious activity.

How did the ZenPatient breach occur?

ZenPatient has not publicly disclosed precisely how the breach occurred. The sample California notification letter does not identify the initial point of entry or indicate whether the incident involved phishing, stolen credentials, malware, an unpatched vulnerability, or another technique.

When did the ZenPatient breach occur?

According to its sample California notification letter, one or more unauthorized actors accessed or copied certain data within ZenPatient’s network sometime between December 5, 2025, and February 12, 2026. ZenPatient identified suspicious network activity on or around February 27, 2026 and subsequently investigated the incident with outside cybersecurity and data-privacy specialists.

How many people were affected by the ZenPatient breach?

ZenPatient has not publicly disclosed the breach’s total affected population. Its notice states that approximately 52 Rhode Island residents may have been affected, while its California regulatory filing indicates that notices were sent to more than 500 California residents.

What information was exposed in the ZenPatient breach?

• The ZenPatient data breach involved individuals’ names and additional personal information specified in each recipient’s notification letter. Because those additional data elements were omitted from the publicly filed sample notice, the complete categories of exposed information have not been publicly disclosed. Breached data reportedly may include, but is not necessarily limited to:
  • name
  • additional personal information

Has ZenPatient offered free credit monitoring and/or identity theft protection services?

Yes. ZenPatient is offering affected individuals 12 months of complimentary Experian IdentityWorks credit monitoring and identity-theft protection services. The available benefits include Experian credit-file monitoring, identity-restoration assistance, continued identity-restoration support after the membership ends, and up to $1 million in identity-theft insurance, subject to the applicable terms and limitations.

According to the sample California notification letter, eligible individuals must enroll by October 31, 2026, at 11:59 p.m. UTC using the activation code provided in their individual notice. No credit card is required to enroll. Identity-restoration assistance is available for 12 months from the notice date and does not require advance enrollment.

ZenPatient data breach timeline:

Date	Event
December 5, 2025	Unauthorized activity began.
February 27, 2026	ZenPatient discovered the incident.
February 12, 2026	Unauthorized activity ended.
July 1, 2026	Data breach investigation concluded.
July 17, 2026	ZenPatient began notifying affected individuals.

Who is ZenPatient?

ZenPatient, Inc. is a Delaware-incorporated healthcare technology company based in Los Angeles, California. ZenPatient, Inc. provides telehealth software and infrastructure for healthcare businesses and medical practices. Its platform supports services such as online patient intake, patient portals, secure messaging, electronic prescribing, billing, e-commerce, pharmacy fulfillment integration, and access to a nationwide network of clinicians. ZenPatient also offers white-label technology and application programming interfaces (APIs), allowing organizations to develop and operate virtual-care services under their own brands.

What should you do if you received a ZenPatient data breach letter?

If you received a ZenPatient data breach letter, confirm that it is addressed to you and review the section identifying the specific information involved. The public sample notice lists names but omits the additional data elements, so your individual letter may contain important details not available in the public filing.

Consider enrolling in the 12 months of complimentary Experian IdentityWorks services offered by ZenPatient. The sample notice gives an enrollment deadline of October 31, 2026, at 11:59 p.m. UTC. Use the unique activation code in your letter, do not share that code, and carefully verify the enrollment website before entering personal information. No credit card should be required.

Continue monitoring bank, credit-card, insurance, and other relevant accounts for unfamiliar activity. Review your credit reports for accounts, inquiries, or addresses you do not recognize. Credit reports are available through AnnualCreditReport.com, the federally authorized source.

You may also consider placing a free fraud alert or credit freeze. A fraud alert instructs businesses to take additional steps to verify your identity, while a credit freeze more strongly restricts access to your credit file. A freeze must be placed separately with Equifax, Experian, and TransUnion and can be lifted when you need to apply for credit. The Federal Trade Commission explains both options.

Be cautious of emails, calls, or text messages claiming to concern the ZenPatient breach. Do not disclose passwords, activation codes, Social Security numbers, or financial information in response to an unsolicited communication. Keep the notification letter and related records. If you discover identity theft or fraud, contact the affected institution immediately and report it through IdentityTheft.gov to obtain a personalized recovery plan.

ZenPatient Submitted Breach Notification Sample (California)

The California sample notice (filed with the Attorney General of California) describes the ZenPatient data breach, including the type of information that may have been involved and the steps offered to affected individuals.

Open the ZenPatient Data Breach Notice in a New Tab

Sources and additional information about the data breach:

• • ZenPatient Website
  • ZenPatient Submitted Breach Notification Sample (California Attorney General)
  • FTC Consumer Advice: Identity Theft
  • IdentityTheft.gov
  • IRS Identity Theft Guide for Individuals
  • U.S. Department of Health and Human Services Office of Inspector General: Medical Identity Theft
  • IdentityTheft.gov: What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach

Class Action FAQ

About This Data Breach Resource

This page was created to give affected individuals and researchers a clear, comprehensive explanation of the ZenPatient data breach. It summarizes what is currently known about the incident, including the timeline, how the breach was discovered, the types of information involved, the number of people affected when available, important notice dates, and steps individuals may want to take after receiving a data breach notification.

This resource is independently written and organized to help readers understand the breach without having to review multiple notices, state attorney general filings, company statements, and related materials. When available, this page relies on primary sources and identifies key facts, unanswered questions, and updates as new information becomes public.

This page is especially relevant for readers searching for information about the ZenPatient data breach, ZenPatient data breach notice, ZenPatient class action investigation, what information was exposed, how many people were affected, and what affected individuals should do next.

Abington Cole + Ellery reviews data breach incidents involving sensitive personal information, financial information, and protected health information. This page is intended to help affected individuals understand the publicly reported facts, the types of information that may have been involved, and practical steps that may reduce the risk of identity theft or medical identity theft.

The information on this webpage is provided for general informational purposes only and does not constitute legal advice. Nothing on this page should be relied upon as legal advice for any particular situation. Submitting information through this page does not create an attorney-client relationship.

For more information about steps you can take to possibly reduce the risk harm arising from a data breach, please review the following article: What are some steps you can take if you've been the victim of a data breach?

This website is not associated with nor authorized by ZenPatient or any affiliated companies. If you have received any other data breach notifications, you may want to review Abington Cole + Ellery's current list of data breach investigations.