Short answer
Quantum Health, a Dublin, Ohio company that coordinates care for members of employer health plans, says a user answered a vishing call on 29 May 2026 and an unauthorized party then accessed and took files until 1 June. The company confirmed on 8 July that some files held member information and began notifying plans on 27 July.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Quantum Health, Inc. |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Healthcare navigation (self-insured employer health plans) |
| Country | United States |
| Detected | 2026-06-01 |
| Disclosed | 2026-08-17 |
| People or records affected | Not stated by Quantum Health; Vermont's listing records 2,360 Vermont residents |
What data was exposed
- Names, dates of birth, email and home addresses, phone numbers, demographic information
- Health insurance information such as policy numbers and claims or benefits information
- Health information: medical and treatment information, diagnoses, prescriptions, provider names, dates of service
- Social Security numbers could not be ruled out for some people
What happened
Quantum Health provides healthcare navigation and care coordination to employers with self-insured health plans. In its notice filed with the California Attorney General, the company says it detected a service outage on 1 June 2026 that affected internal and external systems. It isolated its systems, started an investigation with third-party forensic experts and reported the incident to federal law enforcement.
The investigation traced the outage to unauthorized access that began when a user responded to a vishing call on 29 May 2026. Between 29 May and 1 June the unauthorized party accessed and acquired files from certain systems. On 8 July the company determined that some files held member information, and it began notifying the health plans on 27 July.
What data was involved
The letter says the files contained a name plus one or more of the following: health insurance information (such as policy number or claims or benefits information), health information (medical and treatment information, diagnoses, prescriptions, provider names and dates of service), and other personal details such as date of birth, email, address, phone number or demographic information. It adds that the company could not rule out that a Social Security number was also involved.
HIPAA Journal reported the incident on 17 August, noting that the number of affected people had not been made public. The Vermont Attorney General’s listing shows a Quantum Health filing dated 28 October with 2,360 Vermont residents, listing Social Security numbers and health records. That is one state’s count, not the national total.
What Quantum Health is offering
It is providing identity monitoring through Kroll at no cost, including credit monitoring, fraud consultation and identity theft restoration. The activation deadline and length of service are set in each letter. The help line is (844) 958-8913, Monday to Friday, 9 a.m. to 6:30 p.m. Eastern.
What is still unknown
- how many people in total are affected;
- how many employer plans were involved;
- whether any of the files have been published or sold.
Staying safe
A caller who knows your diagnosis or your plan’s name can sound convincing, and this incident began with exactly that kind of call. Our guide to vishing and callback phone scams explains how to verify a caller, health insurance and Medicare scams covers fake plan calls, and what to do after a data breach covers freezes and monitoring.
More recent incidents are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Calls or texts from someone posing as Quantum Health, your employer's benefits team or your health plan, quoting a diagnosis, prescription or visit date
- Fake credit-monitoring or Kroll enrollment links sent by text or email
- Medical billing or insurance scams demanding payment for services you did not receive
- Identity-theft attempts using a Social Security number and date of birth
What to do if you are affected
- 01Look for a letter from Quantum Health and enroll in the Kroll identity monitoring it offers, using the activation code printed in the letter and the deadline stated there.
- 02Use only the enrollment address in your letter (Enroll.krollmonitoring.com/redeem). Do not follow a link in a message you did not expect.
- 03Review explanation-of-benefits statements and claims for services or prescriptions you do not recognize, and report them to your plan.
- 04Treat any call that offers help with this incident as unverified. Call back using the number on your insurance card or the help line in the letter, (844) 958-8913.
- 05Consider a free credit freeze with Equifax, Experian and TransUnion.
Frequently asked questions
What is Quantum Health?
A healthcare navigation and care coordination company that works with employers that run self-insured health plans. You may be a member through your employer, even if you have never dealt with Quantum Health directly.
How did the intruder get in?
Quantum Health's letter says a user responded to a vishing (voice phishing) call on 29 May 2026. Between 29 May and 1 June the unauthorized party accessed and acquired files from certain systems.
When did the company find out?
It detected a service outage on 1 June 2026, determined on 8 July that some of the files contained member information, and began notifying the health plans on 27 July.
Were Social Security numbers taken?
The letter says Quantum Health could not rule out that your Social Security number was involved. It does not say that every recipient's number was taken.
Has a group claimed the attack?
Quantum Health's letter does not name an attacker. HIPAA Journal reported in August that no group had claimed it and noted the tactics are common to the ShinyHunters group, which is an observation, not an attribution.
Sources
- Quantum Health notice of data security incident (California notification), California Attorney General (organization notice), 2026-10-27
- Quantum Health; Precision Imaging Centers; Heart of America data breaches, HIPAA Journal, 2026-08-17
- Security breach notices, Quantum Health, Inc. (10-28-2026), Vermont Attorney General, 2026-10-28
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.