Marathon Health breach: names, Social Security numbers and health information exported after an impostor tricked an employee
Marathon Health said an unauthorised individual posing as an IT worker tricked an employee into disclosing credentials on August 24, 2026 and exported information from a cloud application, including names, contact information, dates of birth and Social Security numbers, with medical and health insurance information also reported compromised; notification letters began on October 20, 2026.
What happened
Marathon Health, an employer-sponsored healthcare provider that runs workplace health centres across the United States, said it identified suspicious activity related to one of its employee accounts on August 24, 2026 and disabled the account immediately. Its investigation found that an unauthorised individual had posed as a Marathon IT worker and tricked the employee into disclosing their credentials. Those credentials gave access to a cloud-hosted application, and the individual exported information from it within a few hours on August 24. Marathon’s review of the impacted data was completed on September 9, 2026. Notification letters to affected individuals began to be mailed on October 20, 2026, and state attorneys general have been notified; The HIPAA Journal reported the filings on November 3. Marathon is offering affected individuals 12 or 24 months of complimentary credit monitoring.
Who is affected
People whose information Marathon Health held — its patients and the employees and family members enrolled in employer health plans it serves, including people who may never have visited one of its centres: Marathon receives information on enrolled plan members to verify coverage and schedule appointments, so some people receiving a letter may not recognise the company’s name. According to the notification letters to California residents, the impacted data included names, contact information, dates of birth and Social Security numbers; the Texas and Vermont attorneys general also state that medical information and health insurance information were compromised. On counts: the Texas Attorney General’s website lists 234,534 Texas residents affected, Massachusetts lists 29,075 and Vermont 8,858; The HIPAA Journal reports that a law firm, Emery Reddy, says the Texas filing puts the total number of individuals being notified at 5,684,735. The breach is not yet listed on the US Department of Health and Human Services breach portal.
How serious
The combination taken — names, dates of birth, Social Security numbers, plus medical and health insurance information — supports both ordinary identity theft (new accounts, tax fraud) and medical identity fraud, where someone else’s treatment or claims attach to your record. A Social Security number cannot be reissued the way a card can, so the exposure is long-lived. The entry method matters too: this breach began with a fake IT worker persuading an employee to hand over credentials, the same approach now likely to be reused against patients in follow-up phishing that cites the real breach.
What to do now
If you receive a Marathon Health letter, enroll in the credit monitoring it offers and consider a free credit freeze with the three bureaus — a freeze blocks new accounts in your name and can be lifted when you need credit. Watch your health insurance explanations of benefits for care you did not receive, and dispute anything unfamiliar with your insurer in writing. Be wary of calls, emails or texts about this breach that ask for credentials, codes or payment: verify any IT or support request through a number you look up yourself, and never hand over a password or sign-in code to someone who contacted you. Keep the notification letter — it documents what was involved if you later need to dispute a record.
Sources: The HIPAA Journal, November 3, 2026 (reporting Marathon Health’s notification letter filed with the California Attorney General and the state attorney-general filings)