Back Claimdepot

Call-on-Doc Data Breach Exposes Sensitive PHI and PII

Claimdepot • September 22, 2026

Call-on-Doc , a web-based telehealth platform based in Dallas, Texas, experienced a data breach between late December 2025 and early January 2026.

An unauthorized party gained access to Call-on-Doc's network between Dec. 22, 2025, and Jan. 3, 2026.

On Jan. 22, 2026, a threat actor using the name "iProfessor" posted on the open web claiming to be selling a database from Call-on-Doc. The threat actor alleged that the dataset contained 1,144,223 patient records tied to a breach dated December 2025. The data allegedly included patient names, details, addresses, medical categories and conditions, prescribed services, transaction numbers and payment amounts.

On Aug. 19, 2026, the company's investigation determined that protected health information had been potentially accessed or acquired by the unauthorized party during that window. These included patients' names, email addresses, physical addresses, phone numbers, medical diagnoses, medication information and visit types.

The incident has so far impacted 92,012 Texas residents .

The company disclosed the incident to the California Attorney General , as well as posted a notice on its website . The company began notifying affected consumers on Sept. 18, 2026, by U.S. Mail.

Call-on-Doc's response to the breach

The company recommended that consumers take precautionary measures to protect their personal and medical information. These recommendations included monitoring credit files and reviewing medical-related documents for signs of potential misuse.

The notification letter to affected individuals provided information for the three major credit reporting agencies as well as information resources available through the Federal Trade Commission.

Call-on-Doc set up a dedicated call center for individuals with questions the incident. According to the notification letter, the response line is available for 90 days from the date of the letter, between 8 a.m. and 8 p.m. Eastern time, Monday through Friday, excluding holidays.

Social Security Numbers

Affected information types not yet disclosed

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Call-on-Doc Data Breach Exposes Patient Information Call-on-Doc, a telemedicine platform, experienced a data breach from December 22, 2025, to January 3, 2026, when an unauthorized party accessed its network. The breach was detected on December 28, 2025, and a forensic investigation confirmed that protected health information (PHI) was potentially accessed. Affected data includes names, email addresses, physical addresses, phone numbers, medical diagnoses, and medication information. While the threat actor claimed to have stolen data from over 1.1 million individuals, Call-on-Doc has not confirmed the exact number of affected patients. Notifications to potentially impacted individuals began on September 18, 2026, providing guidance on protecting their information. The company has not detected any instances of fraud related to the incident. Call-on-Doc has engaged cybersecurity professionals to enhance security measures following the breach. 3 sources 62

Extracted Entities

Call-on-Doc Data Breach Exposes Sensitive PHI and PII

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)