OpenLoop Health experienced a cybersecurity incident in January 2026 where an unauthorized actor gained access to its systems for approximately one day and exfiltrated personal information of 716,000 individuals. The compromised data included personally identifiable information and medical data but excluded sensitive identifiers such as Social Security numbers and financial information. The breach was disclosed to authorities in March and publicly reported in May 2026. OpenLoop Health responded by terminating access, investigating with external specialists, enhancing security measures, and coordinating with law enforcement. The company also offered identity and credit monitoring to affected users. The exact vulnerability or attack vector used has not been detailed, and no confirmed exploitation of the stolen data has been reported.

The breach exposed personal information of over 700,000 individuals, including names, addresses, email addresses, birth dates, and medical data. Although sensitive identifiers like Social Security numbers and financial account information were not accessed, the exposed data could still pose risks of identity theft or fraud. The company has not reported any confirmed misuse of the stolen information. The incident may affect user trust and could have regulatory and legal implications for OpenLoop Health.

OpenLoop Health has terminated the unauthorized access and conducted an investigation with external cybersecurity experts. The company improved its security controls and is coordinating with law enforcement. Affected individuals have been notified and offered one year of free identity and credit monitoring services. No further action is currently recommended beyond monitoring for potential misuse of personal information. Patch status or specific vulnerability remediation details have not been provided; therefore, check with OpenLoop Health or relevant authorities for any updates.