Marathon Health Data Breach via Social Engineering Exposes Data of 5.7 Million Individuals
Marathon Health, an Indianapolis-based employer-sponsored healthcare provider, has disclosed a data breach affecting approximately 5.7 million individuals, far exceeding its own patient base of around 3 million, due to the company's role in processing data for health plan members who never directly used its services. An attacker impersonating a Marathon IT worker socially engineered an employee into disclosing their credentials, which were then used to access a cloud-hosted application and exfiltrate data over several hours on August 24, 2026. The compromised data includes names, contact information, dates of birth, Social Security numbers, medical information, and health insurance information. No threat actor or ransomware group has claimed responsibility, though the tactics resemble those used by groups such as ShinyHunters and Scattered Spider. Notification letters began mailing on October 20, 2026, and the breach is not yet listed on the HHS OCR portal despite its scale, which would make it the fourth-largest healthcare breach reported this year.
Detalhes técnicos
The unauthorized individual used a help desk/IT impersonation social engineering technique to trick an employee into revealing login credentials. These credentials granted access to a cloud-hosted application from which data was exported within a few hours. Marathon Health disabled the affected account upon detecting suspicious activity and completed its data review by September 9, 2026. Affected organizations include clients such as Indiana University, whose employees enrolled in certain Anthem PPO plans had their eligibility and enrollment data shared with Marathon Health for benefits verification and billing purposes.
Remediação
Marathon Health is offering affected individuals 12 or 24 months of complimentary credit monitoring and has stated it has implemented measures to prevent similar incidents. Affected individuals are advised to monitor notification letters, enroll in offered credit monitoring, and watch for signs of identity theft or fraudulent use of their personal and health information.
Linha do tempo
-
Marathon Health Data Breach via Social Engineering Exposes Data of 5.7 Million Individuals
ler a análise desta fonte ocultar
Marathon Health, an Indianapolis-based employer-sponsored healthcare provider, has disclosed a data breach affecting approximately 5.7 million individuals, far exceeding its own patient base of around 3 million, due to the company's role in processing data for health plan members who never directly used its services. An attacker impersonating a Marathon IT worker socially engineered an employee into disclosing their credentials, which were then used to access a cloud-hosted application and exfiltrate data over several hours on August 24, 2026. The compromised data includes names, contact information, dates of birth, Social Security numbers, medical information, and health insurance information. No threat actor or ransomware group has claimed responsibility, though the tactics resemble those used by groups such as ShinyHunters and Scattered Spider. Notification letters began mailing on October 20, 2026, and the breach is not yet listed on the HHS OCR portal despite its scale, which would make it the fourth-largest healthcare breach reported this year.
Technical Details
The unauthorized individual used a help desk/IT impersonation social engineering technique to trick an employee into revealing login credentials. These credentials granted access to a cloud-hosted application from which data was exported within a few hours. Marathon Health disabled the affected account upon detecting suspicious activity and completed its data review by September 9, 2026. Affected organizations include clients such as Indiana University, whose employees enrolled in certain Anthem PPO plans had their eligibility and enrollment data shared with Marathon Health for benefits verification and billing purposes.
Remediation
Marathon Health is offering affected individuals 12 or 24 months of complimentary credit monitoring and has stated it has implemented measures to prevent similar incidents. Affected individuals are advised to monitor notification letters, enroll in offered credit monitoring, and watch for signs of identity theft or fraudulent use of their personal and health information.