OpenLoop Health, Inc. Data Breach — Official Case File

From the AG filing description

OpenLoop Health, Inc. operates within the healthcare and digital health technology sector, serving as a critical infrastructure provider that connects healthcare networks, clinicians, and patients across multiple jurisdictions. Because of the nature of its operations, OpenLoop Health handles extensive electronic health records, scheduling data, administrative workflows, and clinical documentation. This unique positioning requires the company to collect, store, and process massive volumes of highly sensitive personally identifiable information (PII) and protected health information (PHI) to facilitate telehealth and in-person care delivery, making it a repository of deeply personal data. In 2026, OpenLoop Health reported a formal data security incident to the Texas Attorney General, signaling a breach of its digital environment. In the healthcare and health-tech sectors, incidents of this nature typically involve sophisticated cyberattacks such as unauthorized intrusion into internal databases, compromise of cloud-hosted administrative portals, ransomware deployments, or vulnerabilities within third-party vendor software supply chains. When threat actors infiltrate healthcare infrastructure, they frequently gain unfettered access to internal servers where vast archives of patient and provider records reside for extended periods before detection. The exposure resulting from the OpenLoop Health incident compromises multiple categories of sensitive data, each creating severe and long-lasting risks for affected individuals. The compromise of full names, dates of birth, and Social Security numbers exposes victims to immediate threats of identity theft and financial fraud, as these core identifiers can be used to open fraudulent credit accounts or file unauthorized tax returns. Furthermore, the potential leak of medical record numbers, health insurance details, diagnosis information, and prescription records exposes patients to medical identity theft, where bad actors utilize stolen health credentials to obtain unauthorized medical services, alter treatment histories, or perpetrate complex healthcare billing fraud against insurance providers. As an entity handling protected health information, OpenLoop Health was bound by stringent legal and regulatory frameworks, most notably the Health Insurance Portability and Accountability Act (HIPAA), the Texas Medical Records Privacy Act, and state data breach notification statutes. These laws mandate rigorous administrative, physical, and technical safeguards—such as robust encryption standards, multi-factor authentication, network segmentation, and continuous vulnerability monitoring—to prevent unauthorized access to sensitive medical data. The occurrence of a data breach of this scale strongly suggests potential failures in maintaining these required security protocols, raising serious questions about whether adequate protective measures were enforced. Receiving a formal data breach notification letter from OpenLoop Health carries significant legal implications, serving as an admission by the company that your confidential records were compromised due to inadequate security infrastructure. Legally, the receipt of this notice establishes standing to participate in class action litigation against the company. Affected individuals do not need to wait until they experience direct financial loss or medical fraud to take legal action; the mere exposure and increased risk of future harm are sufficient grounds to seek accountability. Our firm is actively investigating potential class action claims against OpenLoop Health on a contingency fee basis, meaning there are never any out-of-pocket costs or fees unless we successfully recover compensation on your behalf.