Multiple state attorneys general have been told the healthcare provider breach affected about 5.7 million individuals.

 

What happened

Indiana-based employer-sponsored healthcare provider, Marathon Health, has reported a data breach to the Massachusetts Attorney General, the Vermont Attorney General, and the Texas Attorney General. Currently, the full number of impacted individuals is reported to be 5,684,735, although that number has not yet been reported to the Department of Health and Human Services (HHS).

According to the report provided to the Massachusetts Attorney General (AG), data impacted varied by person but may have included names, dates of birth, contact information, and Social Security numbers.

 

Going deeper

Marathon Health is a large employer-sponsored healthcare provider, partnering with employers, unions, and other public sector organizations. The provider operates 720 health centers in 41 states, and also offers virtual care in all 50 states.

According to the breach notice provided to the California AG on October 29th, the incident was first noticed on August 24th, 2026, when Marathon received an alert that an employee’s accounts had suspicious activity. The employee’s account was disabled that Marathon immediatley began an investigation, ultimately determining that an unauthorized individual successfully posed as a Marathon IT worker. The threat actor used this strategy to obtain the employee’s credentials and used those credentials to access a cloud-hosted application. Following the breach, information was exported. The investigation concluded on September 9th, determining that personal information was obtained.

 

What was said

In their breach notice, Marathon said the entire breach “occurred within a few hours on August 24th, 2026,” showing the speed in which attacks can occur. Marathon Health also said that they have “implemented, and will continue to adopt, additional safeguards to protect and monitor its environment.” Currently, Marathon said they have no evidence that information has been misused but said “it is always a good idea to review financial-related statements you receive.”

 

The big picture

While the true numbers remain unconfirmed by Marathon Health or the HHS, if current reports are accurate then this data breach will be one of the largest of the year, joining organizations like Unlimited Techonology Systems, CareCloud, and Baylor Genetics, who have all faced massive breaches this year.

Considering the way Marathon Health works, it’s possible individuals who use other insurance plans but are eligible for Marathon Health Centers may be impacted. Other individuals, like those part of family plans, may not even realize they have been impacted until they receive a notice. With such a large number of impacted individuals, it’s also likely that notifications will be sent out on a rolling basis, and it may take time for individuals to know if they have been impacted.

 

What’s next

For Marathon Health, there will be many steps ahead of them. Up next, they’ll need to file with the HHS if they haven’t already. Some organizations, especially if they’ve experienced a large breach, take longer to notify the HHS as they complete remaining investigations and work with law enforcement. After that, it’s likely that they will face legal battles from victims in the form of class action lawsuits. It’s also possible that they may be investigated by the HHS’ Office for Civil Rights, if the HHS believes Marathon Health did not adequately protect data. Throughout this process, which could take years, Marathon health will also have to revisit their current policies, practices, and technologies that are meant to safeguard patient data.

 

FAQs

Were other states impacted by the data breach?

It’s currently unclear if other states were impacted, since not every state publishes the data breach notices they receive, or if they will, may not do it as quickly as the three states mentioned prior. However, considering how big this breach may be and the fact that Marathon operates in 41 states, it’s likely that residents in other states were impacted.

 

Was this a social engineering attack?

Yes. The attacker was able to successfully manipulate an employee into believing the actor was part of the company’s IT team. These types of breaches are becoming increasingly common and are linked to an estimated 24% of all breaches, emphasizing the need for greater employee training in this area.