Breaches and incidents
MedImpact Healthcare Systems (pharmacy benefit manager): October 2025 breach notified, Qilin claimed
MedImpact’s notice (filed with the California AG on 25 Sep 2026) says that on 18 Oct 2025 it “identified unauthorized activity within certain systems in...
- Disclosed
- Verification
- Checked against a primary source
What happened
- MedImpact’s notice (filed with the California AG on 25 Sep 2026) says that on 18 Oct 2025 it “identified unauthorized activity within certain systems in its environment” and that data of plan members was in the potentially impacted set; HIPAA Journal lists names, addresses, dates of birth, subscriber numbers, SSNs, insurance and prescription information. Clients were told on 13 Aug 2026; affected clients and counts are not public.
- Root cause: not disclosed.
- HIPAA Journal says the Qilin ransomware group claimed responsibility and claimed to have exfiltrated data; MedImpact does not name it.
- MedImpact enhanced safeguards and monitoring and offers Kroll identity monitoring.