Marathon Health breach reportedly affects 5.7M people, HIPAA Journal says
HIPAA Journal reports state attorneys general were told of a Marathon Health breach affecting about 5.7 million people; check any letter you get.
- Published
- Ecosystem
- Cloud
- Exploitation
- No software vulnerability reported; HIPAA Journal says an unauthorized individual posed as an IT worker to obtain an employee’s credentials.
What happened
According to HIPAA Journal, state attorneys general have been informed of a Marathon Health data breach that reportedly involved personal and protected health information of almost 5.7 million individuals HIPAA Journal. This advisory rests on that single report. HIPAA Journal says a copy of the breach notification letter is available on the California Attorney General’s website, but we have not reviewed the letter ourselves. Everything below is HIPAA Journal’s account, including its description of the notice.
HIPAA Journal says Marathon Health is an Indianapolis-based, employer-sponsored healthcare provider with onsite and near-site health centers across the United States. It describes the notice as saying that suspicious activity tied to an employee account was identified on August 24, 2026, and that the account was disabled and an investigation launched. According to HIPAA Journal, the company learned that an unauthorized individual posed as a Marathon IT worker and tricked the employee into disclosing their credentials. The credentials reportedly gave access to a cloud-hosted application, from which the individual exported information over a few hours on August 24, 2026 HIPAA Journal.
The figures differ by source, according to HIPAA Journal:
- The Massachusetts Attorney General was told 29,075 state residents were affected, and the Vermont Attorney General was told 8,858.
- The Texas Attorney General’s website states 234,534 Texas residents were affected.
- Law firm Emery Reddy reports the Texas Attorney General was told that 5,684,735 individuals are being notified.
What is not confirmed:
- The total of about 5.7 million rests on the Emery Reddy report. HIPAA Journal says the breach is not currently listed on the HHS Office for Civil Rights breach portal, and that the total is not yet confirmed.
- HIPAA Journal says neither ShinyHunters nor Scattered Spider appears to have claimed responsibility, nor has any ransomware group. The attacker’s identity is not confirmed.
Am I affected?
According to HIPAA Journal, the data named in notification letters to California residents included names, contact information, dates of birth, and Social Security numbers. The Texas and Vermont Attorney General websites also reportedly state that medical information and health insurance information were compromised. The company’s review of the impacted data was reportedly completed on September 9, 2026, and letters began mailing on October 20, 2026 HIPAA Journal.
You may be affected without ever having used Marathon Health. HIPAA Journal says the company receives information on all enrolled plan members to verify coverage, communicate benefits, bill insurers, and schedule appointments. It names Indiana University as one affected client, which told employees and family members on two Anthem PPO plans that they could use Marathon Health centers. Whether any other client was affected is not confirmed in the source.
What to do now
- Look for a Marathon Health notification letter, which HIPAA Journal says began mailing on October 20, 2026. If you have one, read which data types it lists for you.
- If you have a letter, use the complimentary credit monitoring it offers. HIPAA Journal says the company is offering 12 or 24 months.
- If you are unsure whether you are covered, ask your employer or plan administrator whether your plan uses Marathon Health. Receiving a letter without having been a patient is reportedly possible.
- Watch for updates: the OCR breach portal listing and any revised totals from state attorneys general. The final count and further details are not confirmed.