HealthConsent
Active breach tracker Fort Washington, PA Disclosed February 5, 2026

WIRX Pharmacy Data Breach 2026: 20,047 Workers' Comp Patients Exposed. Medication History + SSN Stolen. What To Do

WIRX Pharmacy, a Pennsylvania workers' compensation specialty pharmacy, disclosed in February 2026 a December 2025 network intrusion exposing names, Social Security numbers, dates of birth, prescription information, and workers' compensation claim data for 20,047 injured-worker patients. 12 months credit monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated Sources & methodology

Timeline

Dec 6, 2025

Unauthorized access to WIRX network

Dec 7, 2025

Suspicious activity detected; investigation launched

Jan 23, 2026

Forensic review completes

Feb 5, 2026

Public website notice posted; HHS OCR submission

Feb 12, 2026

Individual notification letters mailed; NH AG filing

Data exposed

01

High-risk identity

Enables financial + identity theft

Date of birth Social Security number

02

Health records

Don't expire and can't be reissued

Diagnoses / conditions Medications and treatment information

03

Contact & insurance

Phishing + targeted scams

Full name Home address Financial account / claims information

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Edelson Lechtzin (publicly investigating) Lynch Carpenter (publicly investigating) Strauss Borrelli (publicly investigating) Federman & Sherwood (publicly investigating) Migliaccio & Rathod (publicly investigating) Murphy Law Firm (publicly investigating) Emery Reddy (publicly investigating)
If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

01

Accept credit monitoring

It’s the floor of the response. Take it.

02

Freeze your credit

Free at Equifax, Experian, TransUnion.

03

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

04

Review your EOBs

Insurance statements catch medical identity theft early.

05

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

WIRX Pharmacy (operated by Work Injury RX One LLC) is a Fort Washington, Pennsylvania specialty pharmacy focused on workers’ compensation / injured-worker patients. Founded in 2015, WIRX uses a home-delivery model with 24-to-48-hour shipping and no patient out-of-pocket cost.

On December 6-7, 2025, an unauthorized third party accessed WIRX’s network. WIRX detected suspicious activity on December 7, secured systems, and engaged forensic investigation. The forensic review concluded on January 23, 2026. WIRX posted a public website notice and filed with HHS OCR on February 5, 2026, then mailed individual notification letters and filed with the New Hampshire AG on February 12, 2026 — confirming 20,047 affected (TX 693, MA 8, ME 4, NH 1 residents disclosed).

No ransomware group has publicly claimed responsibility. The Inc Ransom result that appeared in some search summaries relates to a separate, unrelated incident — do not confuse.

What was stolen

  • Full name, date of birth, home address
  • Social Security number
  • Diagnoses and conditions
  • Medications and treatment information (prescription / dispensing history specific to workers’ compensation claims)
  • Financial account / claims information

The workers’ compensation context is unusually sensitive: the data set includes injury context, employer/insurer-linked claims data, and prescription-medication detail in addition to standard PII. For affected injured workers, the prescription history alone can disclose ongoing pain-management treatment that is potentially relevant to employer review, employment background checks, and future insurance underwriting.

What WIRX is offering

  • 12 months of complimentary credit monitoring and identity restoration services (vendor not publicly named)
  • Federal law enforcement notified; internal remediation underway

What to do

  1. Enroll in the offered monitoring through the activation code in your letter.
  2. Place free credit freezes at Equifax, Experian, and TransUnion.
  3. File IRS Form 14039.
  4. Be alert to workers’ compensation insurer outreach that references your prescription history or injury — scammers can use this data to impersonate insurer adjusters.
  5. Stop the ongoing flow of your prescription data. HealthConsent files HIPAA restriction requests across prescription networks and pharmacy benefit managers so the medication-history data exposed in this breach is not continuously re-shared.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.