Call-on-Doc Data Breach: What Information Was Exposed?

Call-on-Doc, Inc. (“Call-on-Doc”), a Dallas, Texas telehealth provider, has announced a data breach that may have exposed personal and health information belonging to current and former patients. The company issued its notice on September 18, 2026.

What Happened in the Call-on-Doc Data Breach?

Call-on-Doc offers online medical consultations and prescriptions for a wide range of medical conditions. According to its notice, the company became aware of unauthorized access to its network on December 28, 2025. It took certain systems offline and hired professionals experienced in handling these incidents to investigate.

On August 19, 2026, the investigation determined that protected health information may have been accessed or acquired by an unauthorized party between December 22, 2025, and January 3, 2026. The company reported the incident to the California Attorney General on September 17, 2026, and issued notice the next day, nearly nine months after it first detected the access.

The total number of people affected has not been publicly confirmed. Separately, a dark web seller claimed in January 2026 to have stolen records for more than one million patients from Call-on-Doc. Call-on-Doc’s notice does not confirm that claim or a number.

What Information Was Exposed?

According to Call-on-Doc’s notice, the information potentially affected may have included:

• Names
• Email addresses
• Physical addresses
• Phone numbers
• Medical diagnosis information
• Medication information
• Visit type

The information involved may vary by individual, and not everyone had every data element exposed. Health information tied to a name and contact details is highly sensitive. It can be used for medical identity theft, insurance fraud, and targeted phishing, and it can reveal private details about a person’s health that they never intended to share.

What Should You Do After the Call-on-Doc Data Breach?

If you received a notice from Call-on-Doc, or believe your information may have been affected, consider taking these steps:

• Review your notice. Read it carefully, and keep a copy for your records.
• Review your health and insurance statements. Look at explanation-of-benefits statements and pharmacy records for services or prescriptions you didn’t receive, which can be a sign of medical identity theft.
• Check your credit reports. You’re entitled to a free report each year from Equifax, Experian, and TransUnion.
• Consider a fraud alert or credit freeze. Both are free and make it harder for someone to open new accounts in your name.
• Protect your insurance information. Share your health insurance card only with your healthcare providers and family members covered under your plan.
• Be cautious of unsolicited contact. Be wary of unexpected emails, texts, or calls that reference your diagnosis, medication, or appointments and ask for personal or payment information.
• Use the call center. Call-on-Doc has set up a dedicated call center for questions, available for 90 days from the notice date. The number is in your notice.

Can You Take Legal Action After the Call-on-Doc Data Breach?

If your personal information may have been exposed in the Call-on-Doc data breach, you may have questions about your rights and potential legal options. Whether you can bring a claim depends on the circumstances of the incident and the harm you suffered.

Morgan & Morgan is investigating data breach incidents to help determine whether affected individuals may have legal options. See if you qualify for a case.