MedImpact Data Breach: What Health Plan Members Need to Know

According to notification letters filed with the California Attorney General on behalf of a client health plan, MedImpact Healthcare Systems, Inc. states that on October 18, 2025, it identified unauthorized activity within certain systems in its environment. MedImpact reports that it promptly took steps to secure the affected systems, engaged cybersecurity experts to assist with the investigation and response, and then conducted a detailed review of the data that may have been impacted to determine whose information was included.

In a public statement dated October 27, 2025, MedImpact said it had identified ransomware on certain systems, immediately began containment and mitigation measures, launched an investigation with a leading cybersecurity firm, and was notifying all applicable authorities. The company said it was restoring impacted systems in a new environment segregated from the prior infrastructure, and that pharmacy claims for all clients were again adjudicating. Around the same time, a ransomware group known as Qilin publicly claimed responsibility on its leak site; MedImpact has not publicly named a group, and the claim has not been confirmed by the company. Notification letters to plan members were filed with the California Attorney General in mid-September 2026, roughly eleven months after the activity was identified.

In its letters, MedImpact states that the information involved varied by individual and consisted of the member’s first and last name together with additional data elements identified in each recipient’s letter. The specific categories are not itemized in the sample notices filed with the California Attorney General, so exactly which information was involved for any given member has not been publicly detailed. MedImpact states it has no reason to believe the information has been or will be misused.

Because MedImpact processes pharmacy benefits, the data it holds about plan members can include prescription and claims details alongside identifying information, so members may wish to treat the situation with appropriate care even though the company has not confirmed specific categories. Reporting on the leak-site claim indicates the material posted consisted largely of business documents such as financial summaries and remittance logs rather than member health records; that reporting reflects the threat actor’s postings, not a statement by MedImpact.

MedImpact is a San Diego-based pharmacy benefit manager that administers prescription drug benefits on behalf of health plans and employer-sponsored plans. Because it acts as a service provider to those plans, the individuals potentially affected are members of MedImpact’s client plans rather than direct customers of MedImpact. The California filing was made for members of the Leggett & Platt, Incorporated Employee Benefits Plan, and MedImpact issued separate notices for adult members and for the parents or guardians of minor dependents, indicating that children’s information may be among the data involved.

Other client plans may be notifying their members separately, and MedImpact has not published a total number of affected individuals. As of this writing, the incident does not appear on the U.S. Department of Health and Human Services breach portal under MedImpact’s name. If you or your child received a letter from MedImpact, or from your health plan referencing MedImpact, that notice may indicate your information was among the data reported to have been affected.

MedImpact reports that it secured the affected systems, engaged cybersecurity experts, notified applicable authorities, rebuilt impacted systems in a segregated environment, and has taken steps to further enhance its security safeguards and monitoring. The company states it has no evidence that any personal information has been or will be misused.

Notably, the sample notices filed with the California Attorney General do not include an offer of complimentary credit monitoring or identity protection services. Instead, the letters enclose general resources describing how to obtain free credit reports, place fraud alerts, and request a security freeze. Members should review their own letter, since terms can differ between plans and notification rounds.

Given that no monitoring service is offered in the California notices, affected members may wish to take these steps on their own:

• Consider a credit freeze or fraud alert. Both are free through Equifax, Experian, and TransUnion. Parents and guardians can also request a free security freeze on a minor child’s credit file, which can help prevent accounts from being opened in the child’s name.
• Review your Explanation of Benefits and pharmacy statements. Watch for prescriptions, claims, or services you or your child did not receive, which can be a sign of medical identity theft.
• Check your credit reports. You are entitled to free credit reports at annualcreditreport.com.
• Keep your notice. It identifies the specific information involved for you or your child and may be important if you explore your options.
• Stay alert to phishing. Be cautious of unexpected emails, calls, or texts referencing MedImpact, your health plan, or the incident, and verify any outreach independently before responding.

This information is a general overview and is not legal advice; your situation may differ, and consulting a legal professional can help you understand rights that may apply to you.

If your personal or health information, or your child’s, may have been involved in the MedImpact data breach, do you know what your options are? Our nationally recognized, award-winning team is here to help you understand your rights. Wilshire Law Firm offers free consultations and free case reviews with a legal professional, and we are available 24/7. Because we work on a contingency basis, there are no fees unless you get paid.

Contact Wilshire Law Firm today to schedule your free case review and get your questions answered.