Marathon Health Data Breach: Someone Posing as IT Exported Data Within Hours

In notice letters filed with state attorneys general on October 29 and 30, 2026, Marathon Health says it received an alert on August 24, 2026, about suspicious activity on one employee’s account. The company says it disabled the account right away and began investigating with cybersecurity professionals.

That investigation found that someone posing as a Marathon IT worker obtained the employee’s credentials, used them to reach a cloud-hosted application, and exported information. According to the letter, it all happened within a few hours that day and involved information Marathon keeps in one of its back-end health care operations databases. On September 9, 2026, Marathon confirmed that personal information had been taken. HIPAA Journal reports that no ransomware group appears to have claimed responsibility.

The letter says the information varied from person to person and may have included names, dates of birth, contact information, and Social Security numbers.

State records describe more. The Texas Attorney General’s entry lists addresses, medical information, and health insurance information alongside names, birth dates, and Social Security numbers. Vermont lists Social Security numbers and health records, and the Massachusetts breach report marks both Social Security numbers and medical records. Marathon says it has no evidence that anyone’s information was or will be misused.

Marathon Health provides on-site, near-site, and virtual care to employees of various organizations and their family members. Its website lists more than 720 health centers and 1,600 providers in 41 states, working with employers, public-sector organizations, and unions.

HIPAA Journal reports that you could receive a letter even if you never visited a Marathon clinic, because Marathon can receive information on everyone enrolled in a client’s health plan so it can verify coverage, bill insurers, and schedule appointments.

Marathon hasn’t published a total. State filings count 234,534 Texans, 29,075 Massachusetts residents, and 8,858 Vermonters, and because Marathon filed in California, more than 500 California residents are generally understood to be involved. HIPAA Journal, citing a law firm’s account of the Texas filing, reports that roughly 5.7 million people are being notified; the Texas list doesn’t show that figure, and Marathon hasn’t confirmed it. As of November 3, 2026, the incident isn’t on the federal HHS breach list.

Marathon is offering a free Epiq Monitoring Solutions membership, and each letter says whether it runs 12 or 24 months. The package includes one-bureau credit monitoring, dark web monitoring, fraud consultation, and identity theft restoration, and Marathon says enrolling won’t hurt your credit score. Your letter carries the activation code and the enrollment deadline.

The company says it has added safeguards to protect and monitor its systems and will keep adopting more. The state filings came a little over two months after the August 24 incident.

With Social Security numbers and health insurance details on the state lists, these steps focus on credit fraud and medical identity theft:

• Enroll in Epiq before your deadline. Use the activation code printed in your letter.
• Freeze your credit at Equifax, Experian, and TransUnion. The letter notes that a freeze is free to place or lift and has to be set at each bureau separately.
• Pull your credit reports often. The letter says each bureau offers a free report once a week.
• Read your health plan’s explanation of benefits statements. Look for any visit, prescription, or claim you don’t recognize.
• Keep the letter even if you’ve never been a Marathon patient. As noted above, health plan enrollment records may be involved.
• Be careful with calls, texts, and emails about the breach. Scammers follow news like this, so verify any outreach independently before responding.

This is a general guide, not legal advice. A legal professional can look at your letter and explain which protections and rights apply to you.

Did a Marathon Health letter say your Social Security number may have been taken from a workplace health program’s systems? Wilshire Law Firm, a nationally recognized, award-winning firm, is headquartered in California and handles data breach and consumer protection class actions nationwide. Large breaches like this one are often pursued as class actions. Ask a legal professional about your options in a free consultation or free case review, available 24/7, with no fees unless you get paid.

Contact Wilshire Law Firm to go over your Marathon Health letter.