# zizzl reports a 2026 data event: what the regulator filing establishes Canonical reader page: https://ichrareport.com/news/zizzl-data-event-notice-2026/ Publisher: ICHRA Report Originally published: 2026-10-30 Substantively updated: 2026-10-30 Sources checked: 2026-10-30 Data period: Not recorded [Home](https://ichrareport.com/) [News](https://ichrareport.com/news/) zizzl reports a 2026 data event: what the regulator filing establishes Provider disclosures The official filing reports affected individuals and information categories, while leaving the ICHRA platform scope unestablished. At a glance Evidence **Sourced reporting** Event / data period **Texas regulator publication: October 13, 2026; incident July 9–16; reviewed October 30** Review cutoff **October 30, 2026** By [ICHRA Report](https://ichrareport.com/about/) · Published October 30, 2026 Disclosure reviewed October 30, 2026 zizzl, llc. reported a 2026 data event to state regulators. The Texas filing identifies 6,447 affected individuals, including 496 Texas residents. The filing does not establish that everyone affected used ICHRA or that the ICHRA application was compromised. [source](https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage) ## What the regulator record says Texas Attorney General register record **BR-0005411** , published October 13, records incident dates of July 9–16, 2026, and discovery on August 17. The listed information categories are names, Social Security information and health-insurance information. The entry reports consumer notice by U.S. mail. These are the notifying company's statements in a regulator register, not findings from an independent forensic examination. Massachusetts also lists a zizzl notice in its October 2026 collection. [source](https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage) [source](https://www.mass.gov/lists/data-breach-notification-letters-october-2026) ## What this means for an ICHRA customer A company-level data event and a compromise of a particular application are different claims. The reviewed record does not identify a count of affected ICHRA employers or participants, the complete technical cause, or whether the ICHRA platform itself was involved. Those questions remain open. This 2026 record also should not be combined with an earlier, separately disclosed event. Employers using zizzl should establish whether their organization or employees are covered by the notice, which services and records were involved, and what action the company requests. A customer outside the described affected group should not assume exposure solely because it uses the same provider. ## If you receive a notice Read the notice addressed to you and keep a copy. Confirm its contact details through the company's known support route or the official notice before supplying information. Follow the instructions that apply to your record; do not send Social Security numbers, health information or a notice containing personal details to ICHRA Report. The notice, rather than an aggregate news count, is the appropriate starting point for understanding the information involved and any assistance offered. If you need help establishing whether a communication is genuine, use an independently verified company contact. ## Questions an employer can put to its service team - Is our employer account or any employee record within the affected population? - Which legal entity, service, partner and data categories were involved? - Have affected people been notified, and who handles their questions? - Does the event affect enrollment, coverage verification, premium payments or ongoing benefit administration? - What documented remediation and follow-up information can customers receive? These questions support a service review. A public disclosure alone does not establish a comparative security ranking among administrators. An absence of located disclosures would not prove that another service has never experienced an incident. ## Keep the benefit and the service record separate The filing concerns a service provider; it does not change federal ICHRA or CHOICE Arrangement rules. For the provider's described operating role, see our [zizzl health profile](https://ichrareport.com/providers/zizzl-health/). For the responsibilities an employer should document with any administrator, use the [scenario comparison](https://ichrareport.com/compare/ichra-provider-scenarios/). ## Sources and evidence [1 Texas Office of the Attorney General — Data Security Breach Reports: zizzl, llc., BR-0005411 Public register company filing: 2026 incident dates, aggregate counts and categories. Does not establish ICHRA application compromise or an ICHRA participant subgroup. Source reviewed 2026-10-30](https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage)[2 Massachusetts Office of Consumer Affairs and Business Regulation — Data breach notification letters: October 2026, zizzl Official notice collection; do not treat template placeholders as incident facts. Source reviewed 2026-10-30](https://www.mass.gov/lists/data-breach-notification-letters-october-2026) Review dates are recorded for each source above. Company pages are useful for confirming how a product is described, but they do not prove service quality or customer results.