Medimpact Healthcare Systems, an independent pharmacy benefit manager, discovered unauthorized activity within some of its systems on October 18, 2025. The company secured the affected systems, brought in cybersecurity experts to investigate, and later publicly acknowledged a ransomware attack claimed by the Qilin group. This incident affected members of downstream plans, including the Leggett & Platt, Incorporated Employee Benefits Plan.
The breach involved names and other personal information, with specific data elements varying by individual. The exact total number of affected individuals and a comprehensive list of all affected states have not been fully disclosed. While some reports suggested that leaked files did not appear to include personal health information, Medimpact has not formally confirmed the full scope of data types involved.
Details regarding the breach, including the full extent of affected individuals and specific data types, may emerge as investigations continue and notifications are sent. A sample individual notice was submitted to the California Attorney General's office, indicating consumer notifications occurred by September 2026.