MedImpact Healthcare Systems, a pharmacy benefit manager, discovered unauthorized activity on its systems on or about October 18, 2025. The company completed its investigation by July 17, 2026, and subsequently notified affected client organizations on August 13, 2026. Individual notification letters began mailing on September 23, 2026.
The breach exposed various types of personal and health information, including names, addresses, dates of birth, subscriber or member numbers, health insurance information, Social Security numbers, prescription information, treatment information, dates of service, service locations, and provider names. At least 61,702 individuals were affected, specifically those associated with the Leggett & Platt, Inc. Employee Benefits Plan. The U.S. Department of Health and Human Services and the California Attorney General were notified of the incident.
While notifications have been sent, further details regarding the full scope of the incident or any additional affected clients may emerge. Individuals whose Social Security numbers were involved were offered complimentary credit monitoring and identity-theft protection services.