Short answer
Marathon Health, an Indianapolis-based provider of employer-sponsored clinics, began mailing breach letters on 20 October 2026. It says an attacker posing as an IT worker obtained an employee's login on 24 August and exported data from a cloud application within a few hours.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Marathon Health |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Healthcare (employer-sponsored clinics) |
| Country | United States |
| Detected | 2026-08-24 |
| Disclosed | 2026-10-20 |
| People or records affected | About 5.68 million people per a Texas filing (as reported by HIPAA Journal); some state counts are much smaller |
What data was exposed
- Names, dates of birth and contact information (per Marathon's notification letter)
- Social Security numbers (per Marathon's notification letter)
- Medical and health insurance information (listed in Texas and Vermont filings, per HIPAA Journal)
What happened
Marathon Health provides on-site, near-site and virtual care to employees and their families on behalf of employers, unions and public bodies. HIPAA Journal says it serves more than 600 employers and runs over 720 health centers in 41 states.
According to Marathon’s notification letter, an alert on 24 August 2026 flagged suspicious activity on an employee account. Marathon disabled the account and brought in cybersecurity professionals. The investigation found that someone posing as a Marathon IT worker obtained the employee’s credentials, used them to reach a cloud-hosted application, and exported information, all within a few hours that day. On 9 September Marathon confirmed that personal information had been taken. Letters began going out on 20 October.
What data was involved
The letter says the information varied by person and may include name, date of birth, contact information and Social Security number. HIPAA Journal reports that filings on the Texas and Vermont attorney general sites also list medical and health insurance information. The letter says Marathon has no evidence the data was or will be misused.
The numbers
HIPAA Journal reports a Texas filing of 5,684,735 people notified, which the law firm Emery Reddy cited. It also notes a discrepancy: the Texas site lists 234,534 Texas residents. Massachusetts lists 29,075 residents and Vermont 8,858. Some outlets have reported a far smaller national total, so the exact figure is unsettled. We have not seen a Marathon statement giving a total.
What is still unknown
- the confirmed total number of people affected;
- whether any group will claim the attack or publish the data;
- exactly which health information was in the exported application.
Staying safe
A breach that pairs a Social Security number with employer and health plan details gives scammers believable material. Expect messages that mention your workplace clinic or insurer. Our guide to phishing messages explains how to check a sender, and what to do after a data breach walks through freezes and monitoring. If a caller claims to be from a government agency, see government impersonation scams.
More recent incidents are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake 'Marathon Health' or credit monitoring emails and texts asking you to enrol through a link or pay a fee
- Calls from someone who knows your employer and health plan and asks you to verify your Social Security number
- Tax refund fraud or new account fraud using a stolen Social Security number
- Fake benefits or insurance messages that quote your plan details to look genuine
What to do if you are affected
- 01Check whether you have a letter from Marathon Health. Some recipients never visited a Marathon clinic, because the company holds data on enrolled plan members.
- 02Enrol in the free identity monitoring named in your letter, using the instructions in the letter itself and not a link in an unsolicited message.
- 03Consider a free credit freeze with Equifax, Experian and TransUnion, and place a fraud alert if you see anything odd.
- 04Read your explanations of benefits and bank statements for services or charges you do not recognise.
- 05Phone Marathon or your employer's benefits team on a number from their official site before giving anyone personal details.
- 06Report identity theft to the FTC at IdentityTheft.gov.
Frequently asked questions
How many people were affected by the Marathon Health breach?
HIPAA Journal reports a Texas filing listing 5,684,735 people being notified, though the Texas site separately shows 234,534 Texas residents. Other state counts are far lower. Treat the national figure as reported, not independently confirmed.
How did the attacker get in?
Marathon's letter says an unauthorized person posing as a Marathon IT worker obtained an employee's credentials and used them to reach a cloud-hosted application.
Was I affected if I never used a Marathon clinic?
Possibly. HIPAA Journal reports that Marathon receives information on all enrolled plan members to verify coverage and bill insurers, so some people were notified without having received care.
Has a hacking group claimed the attack?
HIPAA Journal says no group or ransomware gang had claimed it at the time of writing. The tactics resemble groups that use phone-based social engineering, but that is the outlet's observation, not a finding.
What is Marathon offering?
The letter offers 12 or 24 months of identity monitoring through Epiq, including credit monitoring, fraud consultation and identity theft restoration.
Sources
- Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals, HIPAA Journal, 2026-11-03
- Marathon Health sample notification letter (template filed with a state attorney general), ClassAction.org (copy of the letter), 2026-10-20
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.