---
title: "Call-on-Doc network-data incident"
description: "Call-on-Doc reported a December 2025–January 2026 network incident involving potential access to patient information."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-13"
canonical_url: "https://www.ally.security/incidents/call-on-doc-network-data-incident-2025"
markdown_url: "https://www.ally.security/incidents/call-on-doc-network-data-incident-2025.md"
stix_url: "https://www.ally.security/incidents/call-on-doc-network-data-incident-2025/stix.json"
---

# Call-on-Doc network-data incident

Call-on-Doc reported a December 2025–January 2026 network incident involving potential access to patient information.

Last modified Nov 13, 2026 · 2 sources

## Summary

- **Environment:** Healthcare-provider network
- **Operational impact:** Certain systems taken offline during response
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Call-on-Doc](https://www.callondoc.com/) detected unauthorized access December 28, 2025. Investigators later determined patient information may have been accessed or acquired between December 22 and January 3, 2026. [1](#source-1)

## Impact

Potential data included contact details, diagnoses, medication information and visit types, varying by patient. [1](#source-1) The [HHS OCR register](https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf) lists **648,535 affected individuals** for Call-on-Doc, with a September 18, 2026 submission. [2](#source-2)

## Timeline

### December 28, 2025 — Unauthorized access detected

Call-on-Doc took certain systems offline. [1](#source-1)

### August 19, 2026 — Potential patient-data impact determined

The investigation established the possible access interval. [1](#source-1)

### September 18, 2026 — Patient notification begins

The [public notice](https://www.callondoc.com/en/Notice) described the incident and data categories. [1](#source-1)

### November 13, 2026 — Briefing updated

This briefing was last reviewed and updated on November 13, 2026.

## Threat Group & Attack Vector

The notice does not establish the entry method or confirm data exfiltration.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific ATT\&CK technique is mapped from the available evidence.

## Response

Call-on-Doc used outside investigators, notified patients and said it was enhancing security practices. It reported no indication of related fraud. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/call-on-doc-network-data-incident-2025/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Call-on-Doc notice of data security incident

official · Call-on-Doc, Inc. · Sep 18, 2026

<https://www.callondoc.com/en/Notice>

<a id="source-2"></a>

### Breach Portal current investigation table

regulatory · U.S. Department of Health and Human Services Office for Civil Rights

<https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Began At · 100% confidence · current**  
   Call-on-Doc network-data incident: 2025-12-22
2. **Resulted In · 100% confidence · current**  
   Call-on-Doc network-data incident: Call-on-Doc detected unauthorized network access December 28, 2025 and took certain systems offline. Its investigation determined August 19, 2026 that protected health information may have been accessed or acquired during December 22, 2025–January 3, 2026.
3. **Resulted In · 100% confidence · current**  
   Call-on-Doc network-data incident: Call-on-Doc engaged external investigators and began notifying affected individuals September 18. It reported no indication of related fraud and said it was enhancing information-security practices.
4. **Affected Organization · 100% confidence · current**  
   Call-on-Doc network-data incident: Call-on-Doc, Inc.
5. **Resulted In · 100% confidence · current**  
   Call-on-Doc network-data incident: Unauthorized access detected; systems isolated
6. **Resulted In · 100% confidence · current**  
   Call-on-Doc network-data incident: Patient notifications begin
7. **Resulted In · 100% confidence · current**  
   Call-on-Doc network-data incident: The HHS OCR register lists 648535 affected individuals for Call-on-Doc, Inc., a Texas healthcare provider, with a September 18, 2026 submission date and network-server hacking/IT-incident classification.
8. **Resulted In · 100% confidence · current**  
   Call-on-Doc network-data incident: Investigation identifies potential health-data impact
9. **Ended At · 100% confidence · current**  
   Call-on-Doc network-data incident: 2026-01-03
10. **Discovered At · 100% confidence · current**  
   Call-on-Doc network-data incident: 2025-12-28
11. **Occurred At · 100% confidence · current**  
   Unauthorized access detected; systems isolated: 2025-12-28
12. **Resulted In · 100% confidence · current**  
   Call-on-Doc network-data incident: Potential data varied by patient and included names, email and physical addresses, telephone numbers, diagnoses, medication information and visit types.
13. **Disclosed At · 100% confidence · current**  
   Call-on-Doc network-data incident: 2026-09-18
14. **Occurred At · 100% confidence · current**  
   Patient notifications begin: 2026-09-18
15. **Occurred At · 100% confidence · current**  
   Investigation identifies potential health-data impact: 2026-08-19

</details>