Notice of data incident

Zaleta Medical Spa & Cosmetic Surgery (“Zaleta”) of Batesville, Arkansas is providing notice about a recent data security incident that may have resulted in unauthorized access to personal patient information. Law enforcement asked Zaleta to delay notifying patients of this incident until now to avoid impeding their investigation. Zaleta takes the privacy of patient information, including protected health information, very seriously and is providing this notice to inform the media about the incident and offer resources to protect patient information.

What Happened?

On September 9, 2025, Zaleta’s Privacy and Security Team discovered that a former employee, while still employed, accessed certain medical systems without authorization between May 27 and June 4, 2025, including patient lists in Zaleta’s electronic medical record system. Zaleta is continuing to investigate how this occurred and whether any of the information has been misused.

What Information Was Involved?

Based on information available at this date, this incident involved records containing patient numbers (system numbers), patient-since dates, names and preferred names, email addresses, phone numbers, dates of birth, addresses, email status for marketing, sex, gender, personal health numbers, referral sources, referred provider, primary/family provider names and contact information, emergency contact name, relation, and phone number, occupations, employer, referring professional, date of first visit, date of last visit, discharge dates, and certain patient notes. The information impacted varies by individual. At this time, it does not appear that any patients’ social security numbers or payment / credit card information were compromised. As of this writing, Zaleta has not received any reports of related identity theft since the date of the incident. Since discovering the incident, Zaleta has confirmed that the affected information does NOT include medical records, treatment histories, chart notes, or discharge notes.

What Zaleta Is Doing

Data privacy is among Zaleta’s highest priorities, and Zaleta is committed to doing everything possible to protect the privacy and security of the personal information in its care. Upon learning of the incident, Zaleta took steps to secure the impacted systems and immediately launched an internal investigation and engaged law enforcement, with whom it is actively cooperating. Zaleta is pursuing legal action to prevent any potential misuse of the information. Zaleta also ensured that the offender’s access credentials were revoked upon their termination on June 4, 2025. Zaleta is implementing additional security measures to strengthen its system, controls, and respond to this incident. Zaleta is also notifying affected individuals and reporting this incident to appropriate authorities and regulatory bodies, including HHS, licensing boards, law enforcement, and the Attorney General, as applicable.

What You Can Do

Based on the information currently available to Zaleta, the health or personal information involved in this incident does not appear sufficient to enable identify theft or affect an individual’s credit. However, anyone with concerns can find guidance on protecting themselves by visiting the websites of the Attorney General of Arkansas at https://arkansasag.gov/divisions/public-protection/identity/how-can-i-protect-myself/ and the Federal Trade Commission at https://consumer.ftc.gov/identity-theft-and-online-security/identity-theft.

Below is a reference guide outlining the resources available to you and the steps you can take to further protect your personal information. Zaleta will provide further updates if any new information indicates that an individual’s credit or identity is at risk.

For More Information

For additional questions, please contact Zaleta toll-free at (866) 834-7182 or at info@zaleta.com.

Zaleta values the privacy and security of patient information and regrets any inconvenience or concern this incident may have caused.



REFERENCE GUIDE

Review Your Account Statements

Carefully review statements sent to you from your healthcare providers, insurance company, and financial institutions to ensure that all of your account activity is valid. Report any questionable charges promptly to the provider or company with which you maintain the account.

Order Your Free Credit Report

You may also periodically obtain credit reports from the nationwide credit reporting agencies. If you discover information on your credit report arising from a fraudulent transaction, you should request that the credit reporting agency delete that information from your credit report file. In addition, under federal law, you are entitled to one free copy of your credit report every 12 months from each of the three nationwide credit reporting agencies. You may obtain a free copy of your credit report by going to www.AnnualCreditReport.com or by calling (877) 322-8228. You may contact the nationwide credit reporting agencies at:

Equifax (800) 685-1111 P.O. Box 740241 Atlanta, GA 30374-0241 http://www.equifax.com/ Experian (888) 397-3742 P.O. Box 9701 Allen, TX 75013-9701 www.Experian.com TransUnion (800) 888-4213 P.O. Box 1000 Chester, PA 19016-1000 www.TransUnion.com


You also have other rights under the Fair Credit Reporting Act (“FCRA”). These include, among others, the right to know what is in your file; to dispute incomplete or inaccurate information; and to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information. For information about your rights under the FCRA, please visit: https://files.consumerfinance.gov/f/201504_cfpb_summary_your- rights-under-fcra.pdf.

Contact the U.S. Federal Trade Commission

You may contact the Federal Trade Commission (“FTC”), law enforcement, or your state Attorney General to report incidents of identity theft or to learn about steps you can take to protect yourself from identity theft. To learn more, you can go to the FTC’s website at www.ftc.gov/idtheft, or call the FTC at (877) IDTHEFT (438-4338) or write to Federal Trade Commission, Consumer Response Center, 600 Pennsylvania Avenue, NW, Washington, DC 20580.

Fraud Alerts and Security Freezes

You may obtain additional information from the FTC and the credit reporting agencies about fraud alerts and security freezes. You can add a fraud alert to your credit report file to help protect your credit information at no cost to you. A fraud alert can make it more difficult for someone to get credit in your name because it tells creditors to follow certain procedures to verify your identity. You may place a fraud alert in your file by calling any of the nationwide credit reporting agencies
listed above. As soon as that agency processes your fraud alert, it will notify the other two agencies, which then must also place fraud alerts in your file.

You can also contact the nationwide credit reporting agencies at the numbers listed above to place a security freeze to restrict access to your credit report free of charge. You must separately place a credit freeze on your credit file at each credit reporting agency. You will need to provide the credit reporting agency with certain information, such as your name, address, date of birth and Social Security number. After receiving your request, the credit reporting agency will send you a confirmation containing a unique PIN or password that you will need in order to remove or temporarily lift the freeze. You should keep the PIN or password in a safe place. If you request a lift of the credit freeze online or by phone, the credit reporting agency must lift the freeze within one (1) hour. If you request a credit freeze or lift of a credit freeze by mail, the credit reporting agency must place or lift the credit freeze no later than three (3) business days after getting your request.

State Specific Information

For residents of the District of Columbia, Iowa, Maryland, New York, North Carolina, Oregon and Rhode Island

You may contact your Attorney General for additional information about avoiding identity theft. If you are a Rhode Island resident, you may also file a police report by contacting local or state law enforcement agencies.


You may use the following information to contact your attorney general:

District of Columbia
Office of the Attorney General
Office of Consumer Protection
400 6th Street, NW
Washington, DC 20001
(202) 442-9828
www.oag.dc.gov

Iowa
Office of the Iowa Attorney General
Hoover State Office Building
1305 E. Walnut Street
Des Moines, IA 50319
(515) 281-5926 /(888) 777-4590
www.iowaattorneygeneral.gov

Maryland
Maryland Office of the Attorney General Consumer Protection Division
200 St. Paul Place
Baltimore, MD 21202
(410) 528-8662
www.marylandattorneygeneral.gov

Oregon
Oregon Department of Justice
1162 Court Street NE
Salem, OR 97301-4096
(877) 877-9392
www.doj.state.or.us


New York
New York Attorney General
Consumer Frauds & Protection Bureau
120 Broadway, 3rd Floor
New York, NY 10271
(800) 771-7755
www.ag.ny.gov

New York
New York Department of State
Division of Consumer Protection
99 Washington Avenue
Suite 650
Albany, New York 12231
(800) 697-1220
www.dos.ny.gov

North Carolina
North Carolina Department of Justice
9001 Mail Service
Center Raleigh, NC 27699-9001
(919) 716-6000
www.ncdoj.gov

Rhode Island
Rhode Island Office of the Attorney General Consumer Protection Division
150 South Main Street
Providence, RI 02903
(401) 274-4400
www.riag.ri.gov

For residents of Massachusetts: Under Massachusetts law, you have the right to obtain any police report filed in connection to the incident. If you are the victim of identity theft, you also have the right to file a police report and obtain a copy of it.


For residents of New Mexico: You have rights under the federal Fair Credit Reporting Act (FCRA). These include, among others, the right to know what is in your file; to dispute incomplete or inaccurate information; and to have consumer reporting agencies correct or delete inaccurate, incomplete, or unverifiable information. For more information about the FCRA, please visit https://files.consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf or www.ftc.gov.