CallonDoc, Inc. Data Breach Notice (California Attorney General)

The filing from CallonDoc, Inc. shows that personal information belonging to an unknown number of California residents was exposed in an incident on December 22, 2025. The company submitted its notification to the California Attorney General on September 17, 2026 — an interval of 269 days, or roughly eight and a half months later.

Personal information now sits in unknown hands

If you received a letter from CallonDoc, some of your personal details are now outside the company’s control. The record lists only “personal information” as exposed. No passwords, no financial account numbers, and no permanent government identifiers such as Social Security numbers appear in the filing. That absence is meaningful: the most dangerous identity-theft building blocks are not confirmed here.

Still, the exposed personal information can be used to attempt fraud, open accounts in your name, or impersonate you in customer-service calls. Medical-related records held by a telehealth provider like CallonDoc often contain dates of birth, addresses, phone numbers, and treatment details. Even without a Social Security number, this combination retains value for identity thieves for years.

What the long notification delay means for you

The 269-day gap between the December 22, 2025 incident and the September 17, 2026 filing is the single most concrete fact in the record. Notification timelines vary by state law and by when an internal investigation concludes, so the delay alone does not prove wrongdoing. It does, however, mean that anyone affected waited nearly nine months before learning their information had been exposed. During that period the data could have circulated without their knowledge.

How to determine whether this breach involves you

CallonDoc is required to notify affected individuals directly, usually by mail to the last known address. If you have not received such a letter, your records were most likely not included. However, if you have moved since December 22, 2025, a letter may have gone to an old address. In that case, contact CallonDoc directly to confirm whether your information was part of the incident. The letter is the only reliable way to know exactly which details applied to you.

Why medical and personal data remain risky long after the breach

Unlike a credit card, personal details tied to healthcare cannot be cancelled or reissued. A date of birth paired with an address and phone number helps fraudsters pass verification checks at banks, insurers, or government agencies. CallonDoc’s telehealth model means the records likely link your identity to specific medical consultations. That linkage can be leveraged for insurance fraud, prescription scams, or blackmail attempts even years later.

The filing does not disclose the root cause, whether data was exfiltrated, or how many people were affected. Those uncertainties leave you with only the confirmed exposure and the passage of time as facts to act on.

What you can still control

Place a fraud alert with the three major credit bureaus. This forces lenders to verify your identity before opening new accounts and gives you an early warning if someone tries to use your details.

Review your Explanation of Benefits statements from every health insurer you have used in the past two years. Look for claims you did not file or services you did not receive. Medical identity theft often surfaces first through unexpected insurance activity.

Monitor your bank and credit-card statements for small test charges. Thieves frequently start with low-value transactions to confirm a stolen identity still works.

Be cautious with any unsolicited call or email claiming to be from CallonDoc, an insurer, or a government agency that asks you to confirm personal details. Use phone numbers you look up yourself rather than numbers provided in the message.

If you have moved since the incident date, update your address with CallonDoc and with every health plan you hold. This reduces the chance that future notices also miss you.