Insightin Health, Inc. Data Breach Notice (Oregon Attorney General)

The personal information of 1,144,686 people is now in unknown hands following a breach at Insightin Health, Inc. If you received a notification letter, your records were part of this incident.

That letter is the most reliable way to know for certain. The company is required to notify affected individuals directly, usually by mail. If you have not received one, it is likely your information was not included. However, if you have moved since September 17, 2025, the incident date, you should contact Insightin Health directly to confirm whether you were affected.

The 169-Day Gap Between Incident and Notification

The breach occurred on September 17, 2025. Insightin Health filed the notice with the Oregon Department of Justice on March 05, 2026 — an interval of 169 days, or roughly 5.6 months. The filing does not disclose when the company discovered the incident or the reason for the time taken to notify.

What the Filing Actually Lists as Exposed

The record names only one broad category: personal information. No passwords, no financial account numbers, no Social Security numbers, and no government identifiers such as driver’s license or passport numbers appear in the disclosed categories. This is important because it rules out several of the most damaging types of exposure that often drive long-term identity theft risk.

Because the filing uses a general term rather than listing specific data fields, the exact details included in any individual’s record are known only through the letter you may have received. The absence of the more sensitive categories that typically trigger urgent credit monitoring is genuine good news within the limits of what the record states.

What This Exposure Still Enables

Even limited personal information retains value to fraudsters. Names combined with dates of birth, addresses, phone numbers, or email addresses can be used to attempt account takeover on other services, file fraudulent tax returns, or impersonate you in customer service calls. While no permanent government identifiers were exposed according to the filing, the data that was taken cannot be changed or reissued.

The information keeps its usefulness for years. Criminal networks buy and sell such records on the dark web long after the initial breach is forgotten. The lack of passwords in the exposed data means your Insightin Health account credentials themselves were not compromised, removing one major vector that often follows these incidents.

The Lifelong Nature of Personal Data Risk

Unlike a credit card that can be canceled or a password that can be reset, personal details do not expire. A breach of this scale — more than 1.1 million people — increases the background noise of fraud attempts you may encounter over the coming years. You cannot make the data disappear, but you can reduce how effectively it can be used against you.

The filing does not reveal whether the data was copied and exfiltrated or simply accessed. In either case, the prudent assumption is that unknown parties now possess it. The record is silent on the root cause and attack method.

Why the Scale Matters to Individuals

With 1,144,686 Oregon residents notified, this is one of the larger breaches reported to the state in recent years. The volume does not change what happened to any single person, but it does mean the pool of stolen records is large enough to attract organized resale and testing by fraud rings.

Your own risk depends entirely on whether your specific records were included and which exact fields applied to you. The notification letter remains the only document that can answer that question definitively.

Practical Steps That Address This Specific Exposure

• Place a fraud alert with the three major credit bureaus. This forces lenders to verify your identity before opening new accounts and is more effective here than full credit freezes because no financial account numbers were listed in the filing.
• Review your Explanation of Benefits statements from any health plans. Even though the exposed category is described only as personal information, medical-adjacent records can sometimes surface in fraud attempts involving insurance or prescription services.
• Monitor tax transcripts annually. Request a transcript from the IRS each year to catch fraudulent filings early, as name and demographic data alone can sometimes support fake returns when combined with other public information.
• Treat unsolicited calls, texts, or emails claiming to be from Insightin Health with suspicion. Fraudsters frequently use breached contact details to run phishing or imposter scams.
• Keep your notification letter and the company’s contact information. If you see suspicious activity that appears linked to this incident, having the original documentation speeds up disputes with banks, insurers, or government agencies.

The core reality is straightforward: your personal information may now be available to parties you did not choose. No passwords were involved, and the filing does not list the highest-risk identifiers. That narrows the threat compared with many breaches, but it does not eliminate it. The steps above focus on the risks that remain.