Zenflow Medical Device Firm Investigated After Data Breach Exposes Sensitive Patient Information
Zenflow, Inc., a South San Francisco-based medical device company specializing in minimally invasive treatments for benign prostatic hyperplasia (BPH), is under investigation following a data breach that may have exposed personally identifiable information (PII). The incident was disclosed to the Massachusetts Attorney General’s office on January 7, 2026.
Founded in 2014, Zenflow develops the Zenflow Spring System, an investigational implant designed to treat urinary obstruction. Despite raising approximately $80 million in funding, the device remains in clinical trials and has not yet received FDA approval. The company employs fewer than 35 people.
The breach potentially compromised sensitive data, including:
- Full names
- Social Security numbers
Zenflow has notified affected individuals and is offering free credit monitoring and identity protection services through Cyberscout (a TransUnion company). Those impacted may also be eligible for compensation, with class action law firm Shamis & Gentile P.A. actively investigating potential legal claims related to privacy violations and identity theft risks.
The incident highlights growing cybersecurity risks in the healthcare and medical device sectors, particularly for companies handling sensitive patient data during clinical trials.
Source: https://www.claimdepot.com/investigations/zenflow-data-breach-2026
Zenflow, Inc. cybersecurity rating report: https://www.rankiteo.com/company/zenflowinc
"id": "ZEN1768259809",
"linkid": "zenflowinc",
"type": "Breach",
"date": "1/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Healthcare/Medical Devices',
'location': 'South San Francisco, California, USA',
'name': 'Zenflow, Inc.',
'size': 'Under 35 employees',
'type': 'Medical Device Company'}],
'customer_advisories': 'Notification letters sent to affected individuals '
'with steps to protect their identity',
'data_breach': {'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['First and last name',
'Social Security number']},
'date_publicly_disclosed': '2026-01-07',
'description': 'Shamis & Gentile P.A. is investigating the Zenflow, Inc. data '
'breach, where sensitive personally identifiable information '
'may have been exposed. Affected individuals may be eligible '
'for compensation.',
'impact': {'data_compromised': 'Personally identifiable information',
'identity_theft_risk': 'High',
'legal_liabilities': 'Potential legal claims for damages related '
'to privacy violations and identity theft '
'risks'},
'investigation_status': 'Under investigation by Shamis & Gentile P.A.',
'recommendations': ['Enroll in free credit monitoring and identity protection '
'services',
'Review credit reports and account statements for '
'suspicious activity',
'Place a fraud alert or credit freeze on your credit file',
'Contact financial institutions if unauthorized activity '
'is detected',
'File a police report if necessary'],
'references': [{'source': 'Shamis & Gentile P.A.'}],
'regulatory_compliance': {'regulatory_notifications': 'Disclosed to the '
'Massachusetts Attorney '
'General’s office'},
'response': {'communication_strategy': 'Notification letters sent to affected '
'individuals with instructions for '
'credit monitoring enrollment',
'third_party_assistance': 'Cyberscout (TransUnion) for credit '
'monitoring and identity protection '
'services'},
'title': 'Zenflow, Inc. Data Breach Investigation',
'type': 'Data Breach'}