OpenLoop Health Data Breach 2026: 716,000 Telehealth Patients Exposed Across 120 Brand Partners. What Was Stolen and What To Do

What happened

OpenLoop Health is a Des Moines, Iowa telehealth infrastructure company that powers virtual-care for approximately 120 direct-to-consumer healthcare brands. If you used a DTC health app for weight-loss medication, men’s-health prescriptions, mental-health visits, or general primary-care telehealth in the last several years, OpenLoop may have processed your visit on the back end even though you never saw the OpenLoop name.

On January 7, 2026, OpenLoop detected unauthorized access to its systems. The intrusion was contained within 24 hours. The next day, a threat actor using the handle “Stuckin2019” posted a sample of stolen data on a hacking forum, claiming to hold 1.6 million records. The forum listing was taken down approximately two days later. The threat actor told the security blog DataBreaches.net that payment was received and the data had been deleted; OpenLoop has not publicly confirmed any payment.

OpenLoop filed with the US Department of Health and Human Services Office for Civil Rights on March 17, 2026, confirming 716,000 individuals were affected. The threat actor’s 1.6 million claim has not been substantiated. State attorneys general in Texas (68,160 residents), California, and Rhode Island (approximately 2,200 residents) received parallel filings.

Notably absent: no filing has been located on the Iowa Attorney General’s 2026 breach list despite OpenLoop being headquartered in Iowa. No standalone OpenLoop incident notice page exists on openloophealth.com (the URL openloophealth.com/notice-of-data-security-incident returns a 404). The only first-party public notice is the PR Newswire release.

What was stolen

The OpenLoop notification letter (per the California AG filing) confirms that the compromised data may have included:

• Full name
• Home address
• Email address
• Date of birth
• Medical information

The notification letter explicitly states that electronic health records, Social Security numbers, and financial account information were not affected.

However, the threat actor’s forum posting and sample data included a broader category set: phone numbers, IP addresses, heights and weights, biometric data, prescription information, and FedEx tracking details. The discrepancy between OpenLoop’s letter and the actor’s claim is not officially reconciled. If you have used any OpenLoop-powered telehealth service, assume the broader set may apply.

Who is affected (brand partners)

OpenLoop powers an estimated 120 direct-to-consumer healthcare brands. Most brand partners have not publicly named themselves as affected. Named in independent analyst reporting:

• Remedy Meds (general prescription telehealth)
• MEDVi (DTC health platform)
• Fridays / JoinFridays (weight-loss telehealth)
• Triad RX (prescription services)

If you have used any DTC telehealth brand for weight-loss medications (GLP-1 agonists, semaglutide, tirzepatide), men’s-health prescriptions, mental-health visits, hair-loss medications, or similar virtual-care services, your visit may have been processed through OpenLoop. The brand you saw on the app or website is not necessarily the entity that handled the underlying health data. Check whether your prescription bottle, insurance billing, or appointment confirmation references OpenLoop Health.

What OpenLoop is offering

Affected individuals are being directed to IDX (a ZeroFox-owned identity-protection vendor) for 12 months of complimentary identity and credit monitoring, including fraud consultation and CyberScan monitoring.

• Enrollment: response.idx.us/OpenLoop (activation code from the notification letter required)
• Phone: 1-844-539-9781
• Enrollment deadline: June 17, 2026
• Direct OpenLoop contact: Larry Trittschuh, 1-844-819-7956

Credit monitoring catches identity theft signals on the credit report side. Because SSN and financial account info were not exposed in this breach, the more pressing concern is targeted phishing using your prescription and medical details, and the long tail of your health data circulating through downstream data brokers and ad-tech buyers.

What to do if you received a notification letter

This week:

1. Enroll in IDX before June 17, 2026. The deadline is firm.
2. Treat any unexpected pharmacy, FedEx, or telehealth-related email or text as a probable phishing attempt. The actor’s data included FedEx tracking details, which gives criminals enough specificity to craft very convincing “your prescription shipment has an issue, click here” scams.
3. Change passwords on any DTC telehealth service you have used. Email address and date of birth are common password-reset fields.

This month:

4. Stop the ongoing flow of your prescription and telehealth data. HealthConsent files HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across data brokers, ad-tech buyers, and consumer-health platforms so the prescription and behavioral-health data exposed in this breach is not continuously re-sold downstream.
5. Audit which DTC health brands you have ever used. If any of them are OpenLoop-powered, request data deletion from each of those brands separately under CCPA / Washington MHMDA / Connecticut / Virginia / Colorado state privacy laws.

Frequently asked questions

How do I know if I am affected?

You may not know. Most OpenLoop brand partners have not publicly disclosed their relationship with OpenLoop. If you used any DTC telehealth product in 2025 or early 2026, especially weight-loss, men’s-health, mental-health, or prescription-renewal services, you may be included. Watch your mail for an IDX-branded notification letter and the OpenLoop enrollment code.

Why does the threat actor claim 1.6 million but OpenLoop says 716,000?

OpenLoop’s number reflects the records the company has confirmed were exposed in the forensic investigation. The actor’s claim is unverified. The discrepancy could reflect: (a) actor exaggeration, (b) deduplication differences, (c) records the actor accessed but did not exfiltrate, or (d) records OpenLoop has not yet identified as affected. The OCR-filed number is the authoritative count under HIPAA.

Was a ransomware group involved?

No. “Stuckin2019” presented as a lone individual. The actor told DataBreaches.net that the data was deleted after payment, but no group like BlackCat, Cl0p, Medusa, or RansomHub claimed responsibility. The incident does not fit the ransomware-as-a-service pattern.

Should I sue?

At least four federal class actions have been filed in the Southern District of Iowa (Des Moines Division): Morehart v. OpenLoop Health (4:26-cv-00074), Alvarez v. OpenLoop Health (4:26-cv-00083), Allen v. OpenLoop Health (4:26-cv-00097), and Mendosa v. OpenLoop Health (4:26-cv-00123). Multiple plaintiffs’ firms are accepting affected individuals (see Quick Facts above). We are not a law firm and cannot give legal advice.

Is HealthConsent affiliated with OpenLoop or any of its brand partners?

No. HealthConsent is an independent health-data privacy service.

Continue reading

• Your eight HIPAA rights, in plain English
• TriZetto Provider Solutions Breach 2026 (3.4M affected)
• QualDerm Partners Breach 2026 (3.1M affected)
• Other 2026 healthcare data breaches