Episource data breach
Was I affected?
Episource confirmed a breach affecting about 5.4 million people, exposing names, addresses, phone numbers and email addresses. You may be affected if Episource mailed you a notice letter in 2025; the letter names the health plan or provider whose records were involved.
| Announced | Jun 6, 2025 |
|---|---|
| When it happened | January 27 - February 6, 2025 |
| People affected | 5.4 million |
| Data exposed | Names, Addresses, Phone numbers, Email addresses, Dates of birth, Social Security numbers, Medical information and Health insurance details |
| Status | Confirmed by the company or a regulator filing |
What happened
Episource, an Optum-owned company that does medical coding and risk-adjustment work for health plans and providers, told HHS that about 5.4 million people were affected by a ransomware attack in early 2025. Copied files could include contact details, Medicare/Medicaid and insurance IDs, Social Security numbers, diagnoses, test results and medications. Patients often had no direct relationship with Episource, which handled their records for their doctors or insurers.
What should I do?
- Read every Explanation of Benefits from your health insurer and report any visit, test or prescription you never had.
- Freeze your credit for free at Equifax, Experian and TransUnion so no one can open new accounts in your name.
- Sign up for the free credit or identity monitoring offered in the notice letter before its enrollment deadline.
- Request an IRS Identity Protection PIN so nobody can file a tax return with your Social Security number.
Check the other services you use →
Sources
- 5 million affected by Episource data breach · The Record (news)
- Data breach at healthcare services firm Episource impacts 5.4 million people · SecurityWeek (news)