Marathon Health data breach
Was I affected?
Marathon Health confirmed a breach affecting about 5.7 million people, exposing names, dates of birth, Social Security numbers and addresses. You may be affected if you or a family member used a Marathon Health clinic or were enrolled through an employer, union or public-sector health plan that works with Marathon (for example Indiana University), even if you never visited a clinic.
| Announced | Oct 29, 2026 |
|---|---|
| When it happened | August 24, 2026 |
| Country | United States |
| People affected | 5.7 million |
| Data exposed | Names, Dates of birth, Social Security numbers, Addresses, Medical information and Health insurance details |
| Status | Confirmed by the company or a regulator filing |
What happened
Marathon Health, which runs employer-sponsored onsite, near-site and virtual clinics, said someone posing as its IT staff tricked an employee into handing over login details on August 24, 2026, then used them to export data from a cloud-hosted application within a few hours. Notices list names, dates of birth, contact details and Social Security numbers, and some state filings also cite medical and health insurance information. Marathon reportedly told Texas regulators that 5,684,735 people are being notified, which would make it one of the largest health data breaches of 2026. It is offering 12 or 24 months of free identity monitoring.
What should I do?
- Enroll in the free Epiq identity monitoring using the code in your Marathon Health letter.
- Place a free credit freeze with Equifax, Experian and TransUnion, since Social Security numbers were included.
- Review explanation-of-benefits statements from your health insurer and report any care or claims you don't recognize.
- Be wary of calls or emails claiming to be from Marathon Health or your employer's health plan that ask for personal or insurance details; call the number in your letter (888-517-6416) instead.
More data breaches in the United States →
Check the other services you use →
Sources
- Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals · HIPAA Journal · news
- Marathon Health Hack Could Affect Nearly 5.7 Million · GovInfoSecurity · news
- Marathon Health notice of data breach (filed with the California Attorney General) · California Attorney General · regulator