240 Data Breach: Digital Health Records Exposed in Indiana
By Data Breach Law Group | Posted on February 18, 2026 · Indiana
An Indiana-based digital health provider, 240, reported a data breach in February 2026, originating from a June 2025 incident that compromised its network infrastructure. This breach may have exposed sensitive personal and health records of individuals, leading to an investigation into the company's security practices.
DataBreachLawGroup.com has announced an investigation into the recent data breach reported by 240, a digital health and wellness software provider operating in Indiana. The company publicly disclosed on February 18, 2026, that it experienced a cybersecurity incident on June 17, 2025, which led to unauthorized access to its systems.
Our investigation focuses on the scope of the compromise and 240's responsibility for protecting highly sensitive personal information. The breach reportedly involved the exposure of critical data categories, including Full Name, Date of Birth, Social Security Number, Medical Record Number, Health Insurance ID Number, Diagnosis and Treatment Information, Prescription Information, and Provider and Treatment Dates.
The exposure of such intimate details carries significant risks for affected individuals. Unlike financial data, health and identity information cannot be easily changed or cancelled, making victims vulnerable to long-term threats such as medical identity theft, fraudulent billing, and targeted scams. This type of breach often leads to ongoing stress and potential financial harm for those whose data is compromised.
Companies like 240, which handle extensive volumes of protected health information, are obligated under federal and state laws, including HIPAA and Indiana's data breach notification statutes, to implement robust security measures. A breach of this nature raises serious questions about whether 240 maintained adequate administrative, physical, and technical safeguards to prevent unauthorized access to its core databases.
For individuals who have received a data breach notification letter from 240, this correspondence signifies that your private information was indeed compromised. You may be entitled to seek accountability and potential compensation for the risks and damages incurred. Our firm is actively reviewing this incident and offers a free, no-obligation case review to help affected consumers understand their legal options. There are no out-of-pocket costs or legal fees unless we successfully recover compensation on your behalf.
Source: Indiana Attorney General breach notification record
If you were affected
Freeze your credit
Place a free credit freeze with Equifax, Experian, and TransUnion. A freeze blocks new accounts from being opened in your name and can be lifted anytime.
Check for medical identity theft
Review the Explanation of Benefits statements from your health insurer for services or claims you never received, which can signal misuse of your medical identity.
Stay alert to targeted scams
Be cautious of calls, texts, or emails that reference this breach. Legitimate organizations won't ask you to confirm sensitive details through an unsolicited message.
Keep your notification letter
Save the notice you received. It documents that your information was involved and is often needed to enroll in any credit monitoring offered or to join a related legal claim.
Did you receive a letter from 240?
A case review is free and confidential. Tell us about your letter and we will explain your options.