Healthcare provider Marathon Health has reported a major data breach affecting approximately 5.68 million people nationwide, potentially exposing Social Security numbers, medical records, health insurance information, names, addresses, and dates of birth. According to an October 30, 2026, filing with the Texas Attorney General, 5,684,735 individuals were affected, including 234,534 Texas residents. The information exposed varies by individual, and officials have not confirmed that every affected person had all categories of sensitive information compromised.
The cybersecurity incident began on August 24, 2026, when an attacker impersonated a Marathon Health IT worker and obtained an employee’s login credentials. The stolen credentials allowed unauthorized access to a cloud-hosted application, where the attacker exported sensitive information from a healthcare operations database within several hours. Marathon disabled the compromised account and launched an investigation with outside cybersecurity specialists. On September 9, the company confirmed that personal information had been obtained. Individuals who never received treatment at Marathon facilities may also be affected because the provider maintains eligibility and insurance information for employees and family members enrolled in participating healthcare plans.
Marathon Health stated that it has no evidence of misuse of the compromised information and is offering eligible individuals 12 or 24 months of identity-monitoring services. Affected individuals should consider freezing their credit, monitoring financial accounts, reviewing health insurance statements, and remaining alert for phishing attempts involving stolen personal information. The breach highlights significant cybersecurity risks associated with IT impersonation, compromised employee credentials, and unrestricted cloud data access. Healthcare organizations should strengthen phishing-resistant multifactor authentication, monitor unusual bulk data exports, and enforce stricter access controls to prevent similar incidents.