Marathon Health reported that it discovered suspicious activity involving an employee account on August 24, 2026. The company said an unauthorized person posing as an IT worker obtained the employee’s credentials, accessed a cloud-hosted application, and exported information that day. Marathon Health confirmed on September 9 that personal information had been obtained. The incident was reported to authorities in Texas, Massachusetts, and Vermont on October 30, 2026.
The reported affected counts were 234,534 people in Texas, 29,075 in Massachusetts, and 8,858 in Vermont, for a total of 272,467. Information that may have been involved varied by person and included names, dates of birth, contact information, Social Security numbers, medical records, and health insurance information. The available source does not specify the date written notices were sent to affected individuals.
These details reflect information reported through October 30, 2026. Further information about the incident, affected individuals, or notification timeline may emerge later.