State attorneys general have been informed about a substantial Marathon Health data breach that reportedly involved the personal and protected health information of almost 5. 7 million individuals. Indianapolis, Indiana-based Marathon Health is an employer-sponsored healthcare provider.
The company partners with employers, labor unions, and public sector organizations and provides advanced primary care through onsite and near-site health centers across the United States. According to its website, the company serves more than 600 self-funded employers, labor unions, and public sector organizations, operates more than 720 health centers in 41 U.
S. states, has around 1,600 providers, and offers virtual care to individuals in all 50 states. Marathon Health has a patient base of around 3 million individuals.
Only a handful of state attorneys general publish information on the number of state residents affected by data breaches. The Massachusetts Attorney General was informed that 29,075 state residents were affected, and the Vermont Attorney General was notified that 8,858 state residents were impacted. While the website of the Texas Attorney General states that 234,534 Texas residents were affected, law firm Emery Reddy reports that the Texas Attorney General was informed that 5,684,735 individuals are being notified.
As a HIPAA-covered entity, the data breach must be reported to the HHS’ Office for Civil Rights (OCR); however, it is not currently listed on the OCR data breach portal. If that total is confirmed, the Marathon Health data breach will rank as the fourth-largest healthcare data breach to be reported by a HIPAA-regulated entity this year. A copy of the data breach notification letter is available on the website of the California Attorney General.
The notice states that on August 24, 2026, suspicious activity was identified related to one of its employee accounts. The affected account was immediately disabled, and an investigation was launched to determine the nature and scope of the activity. Marathon Health learned that an unauthorized individual posed as a Marathon IT worker and tricked the employee into disclosing their credentials.
The credentials provided access to a cloud-hosted application, and the unauthorized individual exported information from that application in the space of a few hours on August 24, 2026. The social engineering tactics – impersonating an IT worker to steal credentials – are used by initial access brokers and several different cybercriminal groups, including the ShinyHunters and Scattered Spider threat groups.
Neither group appears to have claimed responsibility for the attack, nor has any ransomware group. Get The FREE HIPAA Compliance Checklist Immediate Delivery of Checklist Link To Your Email Address Please enable JavaScript in your browser to complete this form. Business Email * Name * First Last Number * Company Name * Get Free Checklist Please Enter Correct Email Address Your Privacy Respected HIPAA Journal Privacy Policy Marathon Health’s review of the impacted data was completed on September 9, 2026.
According to the notification letters to California residents, the impacted data included names, contact information, dates of birth, and Social Security numbers. The websites of the Texas and Vermont Attorneys General also state that medical information and health insurance information were compromised. Marathon Health has taken steps to prevent similar incidents in the future and is offering the affected individuals 12 or 24 months of complimentary credit monitoring services.
Notification letters started to be mailed to the affected individuals on October 20, 2026. Due to how Marathon Health operates, some individuals are likely to receive notification letters informing them that some of their data was compromised, when they have not received any healthcare services from the company. They may not be aware of Marathon Health or why the company has their data.
The reason is that Marathon Health is provided with information on all enrolled plan members to allow it to verify coverage, communicate benefits, bill insurance companies, and schedule appointments. One of the affected clients is Indiana University, which informed employees and family members enrolled in the Anthem PPO HDHP or Anthem PPO $500 Deductible Plan that they are eligible to use Marathon Health centers, and as such, Marathon Health was provided with some of their information.
The post Marathon Health Data Breach Reportedly Affects 5. 7 Million Individuals appeared first on The HIPAA Journal .
Originally published at hipaajournal.com
