WA · AG Filing: Jun 30, 2026 · Recently disclosed — legal window is open
No cost. No obligation. If your data was exposed by Glucobit, Inc. dba Reframe, you may be entitled to financial compensation.
Start Free Review →You may have been affected by the Glucobit, Inc. dba Reframe data breach if:
Glucobit, Inc. dba Reframe was responsible for safeguarding the personal data of its customers and employees. According to a WA state filing, Glucobit, Inc. dba Reframe experienced a data security incident affecting an undisclosed number of individuals, exposing protected health information and medical records. This breach was recently disclosed and the window for legal action is open now.
The tech industry's heavy reliance on third-party vendors and cloud services creates extensive attack surfaces. The Glucobit, Inc. dba Reframe breach may have originated through a compromised vendor, misconfigured cloud storage, or a phishing attack targeting internal systems. Affected users should monitor closely for downstream account compromises.
Glucobit, Inc., doing business as Reframe, operates in the digital health and wellness technology sector, specializing in behavioral health, alcohol reduction programs, and metabolic wellness tracking. Because Reframe provides continuous digital therapeutics, coaching platforms, and habit-tracking applications, the company collects and stores a massive volume of deeply intimate consumer information. This includes not only standard user account details but also sensitive lifestyle logs, self-reported health metrics, biometric tracking data, metabolic health assessments, and daily behavioral journals. Users trust Reframe with this information under the assumption that their private struggles, psychological profiles, and personal health habits will be rigorously safeguarded against unauthorized exposure. In 2026, Glucobit, Inc. reported a significant data security incident to the Washington Attorney General, highlighting critical vulnerabilities in its digital infrastructure or third-party vendor network. While the full forensic scope of the cyberattack continues to be investigated, data breaches affecting digital health platforms typically involve unauthorized access to cloud storage buckets, compromised backend databases, or malicious API exploits. For companies operating in the health-tech space, these incidents often mean that malicious actors gained undetected entry into systems holding confidential user telemetry and behavioral health records, leaving individuals exposed to severe privacy violations. The exposure of data entrusted to health-focused platforms like Reframe carries profound risks for victims. Beyond standard personally identifiable information such as full names and email addresses, a breach of this nature can expose highly sensitive behavioral patterns, mental health tracking logs, metabolic health data, and in some cases, linked financial or payment information used for subscription services. Unlike a lost credit card, which can be easily cancelled, the compromise of intimate health and psychological data cannot be undone. This information can be weaponized by bad actors for targeted phishing schemes, social engineering, medical identity fraud, or exploited on underground forums where personal stigma and private lifestyle habits can be leveraged against victims. As a commercial entity collecting and monetizing consumer health and personal data, Glucobit, Inc. dba Reframe had clear and stringent legal obligations to maintain robust, industry-standard cybersecurity measures. Under Washington state data protection statutes, the Washington Consumer Protection Act, and applicable federal regulatory frameworks regarding digital health records and consumer privacy, the company was required to implement comprehensive administrative, physical, and technical safeguards. The occurrence of a widespread data breach strongly suggests a failure in these mandatory security protocols, such as inadequate encryption, delayed patch management, or insufficient access controls, which directly enabled unauthorized actors to breach their systems. Receiving a data breach notification letter from Glucobit, Inc. dba Reframe serves as formal legal acknowledgment that your private information was compromised due to corporate negligence. Under the law, this notification establishes your legal standing to participate in a class action lawsuit aimed at holding the company accountable for failing to protect your data. You do not need to wait until you have suffered actual financial fraud or identity theft to take legal action; the increased risk of future harm is enough. Our firm handles these complex data privacy cases on a strict contingency fee basis, meaning you pay nothing out of pocket, and we only collect a fee if we successfully recover compensation on your behalf.
Based on the data types reported in this filing:
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
Common categories of compensation in data breach class actions
The hours spent responding to a data breach — canceling accounts, contacting credit bureaus, updating passwords, and investigating fraud — represent compensable economic harm in data breach litigation.
HIPAA violations carry civil penalties between $100 and $50,000 per violation. Where a healthcare organization's negligence led to the exposure of protected health information, class members may recover statutory damages in addition to actual losses.
Fees charged to close and reopen accounts, issue replacement cards, or dispute fraudulent transactions are recoverable in data breach litigation. So are the costs of overdrafts, late payments, and credit damage caused by unauthorized activity.
When login credentials are exposed, the costs of downstream account compromises — password managers, security audits, and recovery costs for hijacked downstream accounts — can be recovered. Courts in recent class actions have awarded damages for credential exposure even without proven misuse.
Data breach victims regularly report anxiety, loss of sleep, and ongoing fear of identity theft. These non-economic harms are cognizable injuries in data breach litigation, particularly in cases involving SSN or medical record exposure.
Applicable State Law
This breach was reported under the Washington My Health MY Data Act, which mandates notification and establishes your right to seek damages.
No. Under Washington My Health MY Data Act and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
If Glucobit, Inc. dba Reframe is a covered healthcare entity or business associate under HIPAA, affected patients have additional rights — including the right to an HHS complaint. These HIPAA violations also strengthen civil damages claims. Consult an attorney to understand your full remedies.
Banks may reverse fraudulent charges, but they are not obligated to compensate you for time lost, stress, or indirect damages. A class action claim against the breached company can recover those additional categories of harm.
State statutes of limitations for data breach claims typically run 2–4 years from the date of the breach or its discovery. Because this breach was recently disclosed, the window is open — but acting early preserves your options and strengthens the case.
Accepting free credit monitoring from Glucobit, Inc. dba Reframe does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Not necessarily. Many data breach victims are never notified directly. If your personal information was held by Glucobit, Inc. dba Reframe during the relevant period, you may still qualify even without receiving a letter. A free eligibility review can confirm your status.
Received a notification letter from Glucobit, Inc. dba Reframe?
Read our dedicated guide — what the letter means and what to do.
Learn how to participate in the class action and what compensation you may be entitled to.
Join the Class Action →Use our verification tool to confirm your letter matches this official AG filing.
Verify My Notice LetterThis case file references a public filing made with the state filing in WA. This website is not affiliated with, endorsed by, or operated by any state government agency.
Glucobit, Inc. dba Reframe breach?
Free case review · No fee unless you win