INDIANAPOLIS — A data breach at Marathon Health, an employer-sponsored healthcare provider based in Indianapolis, Indiana, reportedly exposed the personal and protected health information of almost 5.7 million people, including Social Security numbers and medical records. State attorneys general have been informed, and notification letters began reaching affected people on October 20, 2026, according to a report published November 3, 2026. If confirmed, it would be the fourth-largest healthcare breach reported by a HIPAA-regulated organisation this year.

No software flaw was involved. On August 24, 2026, an unauthorised person posed as a Marathon Health IT worker, tricked an employee into handing over login credentials, and exported data from a cloud-hosted application within hours. The account was disabled the same day; the data review finished September 9, 2026.

Key Points

• Marathon Health, an Indianapolis-based employer-sponsored healthcare provider, reportedly suffered a data breach affecting almost 5.7 million people.
• The breach began on August 24, 2026, when an impostor posing as an IT worker tricked an employee into disclosing credentials and exported data from a cloud application within hours.
• Exposed data includes names, contact information, dates of birth, Social Security numbers, medical information and health insurance information.
• Published state figures include 234,534 Texans, 29,075 Massachusetts residents and 8,858 Vermont residents; Emery Reddy reports Texas was told 5,684,735 individuals are being notified in total.
• Letters began mailing on October 20, 2026, and Marathon Health offers 12 or 24 months of free credit monitoring; no group has claimed responsibility and no ransomware group is linked.

What Happened

According to the notification letter published on the California Attorney General's website, suspicious activity on an employee account was identified on August 24, 2026. The account was disabled at once and an investigation found that an unauthorised individual, posing as a Marathon IT worker, had persuaded the employee to disclose credentials and then exported data from a cloud-hosted application within hours.

The data review finished on September 9, 2026, and letters started mailing on October 20, almost two months after the intrusion. Many people therefore learned of the exposure weeks after their data had left the company's systems. As a HIPAA-covered entity, Marathon Health must report the breach to the Department of Health and Human Services' Office for Civil Rights, but it was not yet on the regulator's public portal when the November 3 report appeared.

Background/Context

Marathon Health partners with employers, labour unions and public sector organisations to provide advanced primary care through onsite and near-site health centres across the United States. It serves more than 600 such organisations, operates over 720 health centres in 41 states, employs around 1,600 providers and offers virtual care in all 50 states. Its patient base is around 3 million people.

The reported 5.7 million total exceeds that patient base because Marathon Health holds data on all enrolled plan members of its client organisations, not only on centre visitors, to verify coverage, communicate benefits, bill insurers and schedule appointments. Some letter recipients will therefore never have used a Marathon centre. Indiana University is one affected client: it told staff and family members on its Anthem PPO plans that they were eligible to use Marathon centres, so Marathon held some of their information.

Marathon Health Data Breach: What Was Exposed and Who Is Affected

The data is unusually sensitive because it combines identity and health details. California letters list names, contact information, dates of birth and Social Security numbers; Texas and Vermont also report medical and health insurance information compromised. That combination is more dangerous than either category alone: a Social Security number can open accounts in someone else's name, while medical and insurance details enable medical identity theft.

The state picture is still emerging, as only a few attorneys general publish their own residents' figures: Massachusetts, 29,075; Vermont, 8,858; Texas, 234,534. Separately, Emery Reddy reports Texas was told 5,684,735 individuals are being notified in total. That larger figure is the national notification total reported to Texas, not the number of Texans affected, and it is the source of the "almost 5.7 million" headline total.

Reactions/Quotes

No group has claimed responsibility and no ransomware group is linked. The report notes that IT-worker impersonation is a tactic also used by initial access brokers and cybercriminal groups, but stresses none of the groups it names appears to have claimed this attack, and no attribution has been made. Online claims of responsibility should be treated with caution unless confirmed by the company or investigators.

Marathon Health says it has taken steps to prevent repeat incidents and offers affected people 12 or 24 months of free credit monitoring. The material reviewed for this article contains no public statement with a named spokesperson's quoted remarks, so no invented quotations are attributed to the company. The incident became public through state filings and letters.

Why It Matters

The breach matters because of what was taken and how. A leaked password can be changed; a Social Security number, a date of birth and a medical history cannot. Victims face a lasting identity-theft risk, plus fraudulent medical claims in their names. And the attacker needed no technical exploit: one convincing impersonation and one employee's trust opened a cloud application holding millions of records, a human weakness harder to patch than any software bug.

What Happens Next

Letters that began mailing on October 20 will keep reaching affected people, including many who never visited a Marathon centre. Recipients should read their letter carefully, take up the credit monitoring offered, and keep the letter, since it states which of their data types were involved. They should also watch statements and explanation-of-benefits notices for unfamiliar medical charges, and consider a fraud alert or credit freeze.

The breach is expected to appear on the HHS Office for Civil Rights portal once reporting is processed, and states may publish fuller figures as more filings surface. Whether it leads to enforcement action or claims will depend on investigators' findings about safeguards in place before August 24. This article will be updated if Marathon Health or the regulator publishes more.

Frequently Asked Questions

How many people were affected by the Marathon Health data breach?

Almost 5.7 million: Emery Reddy reports Texas was told 5,684,735 individuals are being notified.

What data was exposed?

Names, contact information, dates of birth, Social Security numbers, medical information and health insurance information.

How did the breach happen?

On August 24, 2026, an impostor posing as a Marathon IT worker tricked an employee into disclosing credentials and exported data from a cloud application within hours.

Could I be affected even if I never used a Marathon Health centre?

Yes: Marathon holds data on all enrolled plan members of its client organisations, not only centre visitors.

Has anyone claimed responsibility, and is the breach on the federal portal?

No group has claimed it and no ransomware group is linked. It must be reported to the HHS Office for Civil Rights but was not yet on its public portal on November 3.

Read more on US News Pulse: Atorvastatin recall: 13,296 bottles of cholesterol pills pulled nationwide, StatStrip glucose meter recall hits hospitals in FDA's most serious warning, and Binance records $3.64 billion outflows after record $6.3 billion hack.