Call-on-Doc was the subject of a data breach notification filed with the TX Attorney General. The AG filing was recorded on September 21, 2026. The breach or discovery date reported in the filing is December 22, 2025.
Data Exposed
Call-on-Doc was the subject of a data breach notification filed with the TX Attorney General. The AG filing was recorded on September 21, 2026. The breach or discovery date reported in the filing is December 22, 2025.
Call-on-Doc operates as a prominent telehealth and online medical consultation platform, providing patients across the United States with rapid access to medical diagnoses, prescription services, and clinical treatment plans. Because of the digital nature of its business, the company relies heavily on the continuous collection and electronic storage of vast quantities of deeply personal and sensitive information. Patients must share comprehensive medical histories, current symptoms, treatment records, and health insurance details to receive care. Furthermore, to facilitate remote prescriptions and administrative billing, Call-on-Doc routinely captures government-issued identification, contact details, dates of birth, and financial account information. This centralization of confidential health records makes the platform an attractive target for malicious actors seeking to exploit high-value personal data. The 2026 security incident reported to the Texas Attorney General highlights the persistent vulnerabilities inherent in digital healthcare infrastructure. While the exact vector of the breach remains under active investigation, incidents involving telehealth providers typically stem from unauthorized access to cloud-based databases, compromised employee credentials, or sophisticated ransomware attacks targeting electronic health record repositories. In many cases, inadequate network segmentation or outdated security patches allow cybercriminals to infiltrate sensitive perimeters undetected, exfiltrating massive troves of confidential files before the intrusion is identified and contained. The exposure of health-related and personal data in a breach of this magnitude creates severe, long-term risks for affected individuals. The compromise of protected health information (PHI), such as diagnosis details, prescription records, and treatment dates, opens the door to sophisticated medical fraud, where bad actors utilize stolen identities to obtain unauthorized care or bill insurance providers. When combined with foundational identifiers like full names, dates of birth, and Social Security numbers, victims face an elevated, enduring threat of financial identity theft, fraudulent credit applications, and targeted phishing campaigns that leverage intimate medical details to increase the success rate of social engineering attacks. As a provider handling sensitive patient data, Call-on-Doc was legally obligated to implement robust administrative, physical, and technical safeguards under federal and state law, most notably the Health Insurance Portability and Accountability Act (HIPAA) and the Texas Medical Records Privacy Act. These statutory frameworks mandate rigorous encryption standards, continuous access monitoring, and comprehensive vulnerability assessments to prevent unauthorized disclosures. The occurrence of a significant data breach strongly suggests a failure to maintain these required security protocols, potentially exposing the company to significant legal liability for negligence and failure to protect consumer privacy. Receiving a data breach notification letter from Call-on-Doc serves as formal legal acknowledgment that your confidential information was compromised due to corporate security failures. Under modern jurisprudence, the receipt of such a notice often establishes the legal standing necessary to participate in class action litigation, empowering affected consumers to demand accountability and compensation for the time, anxiety, and risk associated with monitoring compromised accounts. Importantly, potential class members are not required to demonstrate immediate financial loss to join the lawsuit, and our firm handles these matters on a strict contingency fee basis, meaning you pay nothing out of pocket unless we successfully recover compensation on your behalf.
Based on the data types reported, affected individuals face:
Your SSN is the master key to your identity. Once exposed, criminals can open new lines of credit, take out loans, or file taxes in your name.
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
What the Texas Identity Theft Enforcement and Protection Act and federal statutes entitle you to recover:
The hours spent responding to a data breach — canceling accounts, contacting credit bureaus, updating passwords, and investigating fraud — represent compensable economic harm in data breach litigation.
Once your SSN is exposed, protection becomes an ongoing expense. Plaintiffs in data breach settlements have recovered costs for credit freezes, identity protection subscriptions, and time spent dealing with fraudulent accounts — sometimes covering multiple years of exposure.
HIPAA violations carry civil penalties between $100 and $50,000 per violation. Where a healthcare organization's negligence led to the exposure of protected health information, class members may recover statutory damages in addition to actual losses.
Fees charged to close and reopen accounts, issue replacement cards, or dispute fraudulent transactions are recoverable in data breach litigation. So are the costs of overdrafts, late payments, and credit damage caused by unauthorized activity.
Several state data breach laws provide for statutory minimum damages — fixed amounts recoverable per affected individual regardless of actual loss. These provisions exist specifically to make legal action viable for victims who have not yet experienced direct harm.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
No. Under Texas Identity Theft Enforcement and Protection Act and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
Immediately place a free credit freeze at all three bureaus (Equifax, Experian, TransUnion). A freeze blocks new accounts from being opened in your name. Then file a complaint with the FTC at IdentityTheft.gov and contact our office — SSN exposure is one of the most serious breach types.
If Call-on-Doc is a covered healthcare entity or business associate under HIPAA, affected patients have additional rights — including the right to an HHS complaint. These HIPAA violations also strengthen civil damages claims. Consult an attorney to understand your full remedies.
Banks may reverse fraudulent charges, but they are not obligated to compensate you for time lost, stress, or indirect damages. A class action claim against the breached company can recover those additional categories of harm.
State statutes of limitations for data breach claims typically run 2–4 years from the date of the breach or its discovery. Because this breach was recently disclosed, the window is open — but acting early preserves your options and strengthens the case.
Accepting free credit monitoring from Call-on-Doc does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Received a notification letter from Call-on-Doc?
What it means and what to do next.
Case review window ends November 16, 2026 — review your letter.
Review Your Letter →Call-on-Doc breach?
Free case review · No fee unless you win