zHealth Data Breach

zHealth provides the practice-management and electronic health records software behind the scenes for chiropractors, physical therapists, massage therapists, and acupuncturists. An intruder was inside its network for two days in January. zHealth didn’t notice for nearly five months.

zHealth, Inc. is a San Francisco-based company that provides cloud-based practice-management and electronic health records (EHR) software to wellness providers nationwide, including chiropractic, physical therapy, massage therapy, and acupuncture practices. According to a notice filed with the California Attorney General, an unauthorized third party accessed zHealth’s network between January 20 and January 21, 2026.

A Five-Month Detection Failure

zHealth states it did not become aware of the intrusion until on or about June 15, 2026, roughly five months after it occurred. The company completed its review of what had been accessed on September 3, 2026, and began notifying affected individuals on September 11, 2026, nearly eight months after the original intrusion.

Who We’re Prioritizing

Emery | Reddy is prioritizing outreach to California residents for this investigation, given that the confirmed disclosure to date has come through the California Attorney General’s office. If you live in California and use, or have used, a wellness provider that relies on zHealth’s software, we want to hear from you.

What Information Was Exposed?

zHealth’s sample notice letter left the list of specific exposed data categories blank, so the exact categories involved remain unconfirmed in the company’s own regulatory filing. A dark-web threat actor using the name Kazu has separately claimed to have leaked approximately 15 gigabytes of data, including more than 1.2 million records containing patient medical information, clinical notes, appointment details, and billing data. Emery | Reddy has not independently verified this claim, and it is separate from zHealth’s own confirmed disclosure. We are including it here because it is a matter of public record that a named actor made this claim about zHealth’s data.

You May Not Have a Direct Relationship With zHealth

zHealth sells its software to wellness practices, not directly to patients, which makes it likely that any notice related to this breach could arrive under the name of your own chiropractor, physical therapist, massage therapist, or acupuncture provider rather than under the zHealth name. If you received a notice from a wellness provider describing a software vendor’s data breach around this timeframe, this may be the incident that applies to you.

Do You Have Legal Options?

Companies that provide software services handling patient health information have a legal duty to safeguard that data and to detect and report intrusions in a timely manner. If you are a California patient of a wellness provider that uses zHealth’s software, you may have rights and remedies under applicable law.

If you are a California resident who received a notice describing this incident, or whose wellness provider uses zHealth’s software, contact the Data Privacy Attorneys at Emery | Reddy for a Free Case Review.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Companies that collect this information are legally required to safeguard it. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Because zHealth handles clinical and appointment data on behalf of healthcare providers, some of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.

Frequently Asked Questions

I’ve never heard of zHealth. Could I still be affected?

Yes, possibly. zHealth sells practice-management software to chiropractors, physical therapists, massage therapists, and acupuncturists, not directly to patients. If your wellness provider uses zHealth behind the scenes, a notice about this breach could arrive under your provider’s name rather than zHealth’s.

How long was the intrusion, and how long did it take zHealth to notice?

The intrusion occurred over two days, January 20 to January 21, 2026. zHealth states it did not become aware until on or about June 15, 2026, roughly five months later, and did not complete its review until September 3, 2026.

What information was exposed?

zHealth’s own sample notice left this blank. A dark-web actor has separately claimed the data includes patient medical information, clinical notes, appointment details, and billing records, but that claim has not been independently confirmed.

How many people were affected?

zHealth has not disclosed a population figure in its California filing.

Do I have to prove my data was misused to have a claim?

No. Companies that fail to detect and disclose a breach in a reasonable time, or fail to safeguard patient data, may be liable regardless of whether misuse has occurred yet.

Do I have a legal claim?

You may. Companies that handle patient health information through practice-management software have a legal duty to protect it. If you are a California resident affected by this incident, contact the Data Privacy Attorneys at Emery | Reddy at 916.995.5968 or www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.