Virta Health Corp. and Virta Medical PC (hereinafter, collectively “Virta Health”) is providing this substitute notice as a result of a security incident to provide individuals with information and to share resources available for those who wish to further safeguard their personal information. The privacy and protection of information is a top priority for Virta Health.

On March 24, 2026, Virta Health identified unauthorized activity limited to a data repository that is separate from our current production platform. Upon discovery, we immediately took steps to secure the environment, initiated an investigation to understand the scope of the incident, engaged external cybersecurity experts to perform an independent review, and notified law enforcement.

The investigation revealed that the incident was limited to the data repository where certain files were potentially accessed. Following a thorough investigation of the impacted data, we discovered that certain personal information may have been exposed. Although the forensic investigation could not rule out the possibility that an unknown actor may have accessed this information, there is no indication that any information has been misused at this time.

Upon completion of that effort, Virta Health began notifying potentially affected individuals for whom valid mailing addresses were available.

Virta Health has established a dedicated assistance line to answer any questions about the incident and to address related concerns. The call center is available Monday through Friday from 8 AM - 8 PM Eastern Time, excluding major U.S. holidays, and can be reached at 833-502-8832. Individuals may also contact us by writing at incident@virtahealth.com.

Additional information is available at https://www.virtahealth.com/notice-of-data-event.

Virta Health takes the privacy and security of information seriously and regrets any concern this incident may cause.

View source version on businesswire.com: https://www.businesswire.com/news/home/20260522302695/en/