zizzl, llc. reported a 2026 data event to state regulators. The Texas filing identifies 6,447 affected individuals, including 496 Texas residents. The filing does not establish that everyone affected used ICHRA or that the ICHRA application was compromised. source
What the regulator record says
Texas Attorney General register record BR-0005411, published October 13, records incident dates of July 9–16, 2026, and discovery on August 17. The listed information categories are names, Social Security information and health-insurance information. The entry reports consumer notice by U.S. mail. These are the notifying company's statements in a regulator register, not findings from an independent forensic examination. Massachusetts also lists a zizzl notice in its October 2026 collection. source source
What this means for an ICHRA customer
A company-level data event and a compromise of a particular application are different claims. The reviewed record does not identify a count of affected ICHRA employers or participants, the complete technical cause, or whether the ICHRA platform itself was involved. Those questions remain open. This 2026 record also should not be combined with an earlier, separately disclosed event.
Employers using zizzl should establish whether their organization or employees are covered by the notice, which services and records were involved, and what action the company requests. A customer outside the described affected group should not assume exposure solely because it uses the same provider.
If you receive a notice
Read the notice addressed to you and keep a copy. Confirm its contact details through the company's known support route or the official notice before supplying information. Follow the instructions that apply to your record; do not send Social Security numbers, health information or a notice containing personal details to ICHRA Report.
The notice, rather than an aggregate news count, is the appropriate starting point for understanding the information involved and any assistance offered. If you need help establishing whether a communication is genuine, use an independently verified company contact.
Questions an employer can put to its service team
- Is our employer account or any employee record within the affected population?
- Which legal entity, service, partner and data categories were involved?
- Have affected people been notified, and who handles their questions?
- Does the event affect enrollment, coverage verification, premium payments or ongoing benefit administration?
- What documented remediation and follow-up information can customers receive?
These questions support a service review. A public disclosure alone does not establish a comparative security ranking among administrators. An absence of located disclosures would not prove that another service has never experienced an incident.
Keep the benefit and the service record separate
The filing concerns a service provider; it does not change federal ICHRA or CHOICE Arrangement rules. For the provider's described operating role, see our zizzl health profile. For the responsibilities an employer should document with any administrator, use the scenario comparison.
Sources and evidence
Review dates are recorded for each source above. Company pages are useful for confirming how a product is described, but they do not prove service quality or customer results.