Marathon Health, a US health care provider, has reportedly told state regulators that data on about 5.68 million people was taken in an August attack. According to the company’s notice, the intruder posed as an IT worker to get an employee’s login, and the stolen records may include Social Security numbers.
What happened
Marathon says it spotted suspicious activity on one employee’s account on August 24, 2026. Its notice says an unauthorized person posed as a Marathon IT worker and obtained that employee’s credentials. Those credentials opened a cloud-hosted application, and the intruder exported data from it within a few hours, according to HIPAA Journal’s reading of a California attorney general filing. Marathon says it disabled the account right away and brought in outside cybersecurity experts.
The company completed its review of the affected data on September 9, 2026, per HIPAA Journal. BankInfoSecurity reports that Marathon filed with several state attorneys general in the days before its November 2 story. The 5.68 million figure comes from a Texas filing as relayed by the law firm Emery Reddy. Both outlets also cite state counts: 234,534 Texas residents, 29,075 in Massachusetts and 8,858 in Vermont. The breach had not appeared on the federal HHS breach portal when HIPAA Journal published on November 3, so the total is still reported rather than officially tallied.
Who is affected
The notice lists names, dates of birth, contact information and Social Security numbers, and what was taken varies by person. HIPAA Journal adds that Texas and Vermont filings also mention medical and health insurance information. Some people notified may never have been Marathon patients: the company receives enrollee data from plan sponsors, and Indiana University told its own employees and family members on October 15 that they were affected, per BankInfoSecurity.
What to do
This section is our analysis, not guidance from Marathon.
- If you get a Marathon notice, treat it as real, but go to the company’s official site rather than clicking links in an unexpected email or text.
- Freeze your credit at Equifax, Experian and TransUnion. Freezes are free and block most new-account fraud that uses a stolen Social Security number.
- Review insurer statements and explanations of benefits for services you did not receive, since health insurance details may be involved.
- Expect follow-on phishing that mentions Marathon, your employer or your health plan. Calls from someone claiming to be IT or benefits support deserve a call-back on a number you already trust.
- Employers and IT teams should require a callback check before any password reset or credential request, and use phishing-resistant multifactor authentication for staff who can reach cloud applications holding personal data.
What we still do not know
- Who carried out the attack. The ShinyHunters group had not listed Marathon on its leak site at the time of BankInfoSecurity’s report, and neither source ties the incident to a named group.
- Whether the 5.68 million total will change once Marathon files with federal regulators.
- Exactly which cloud application was accessed and which records each person had exposed.
- What protection, such as credit monitoring, Marathon is offering. Neither report we reviewed confirms its terms, so check your notice.
Sources: HIPAA Journal, Nov. 3, 2026; BankInfoSecurity, Nov. 2, 2026.
Leave a Reply