What happened in the Marathon Health data breach?

Marathon Health reported a data breach affecting 5,684,735 people nationwide, according to information submitted to the Texas Attorney General. The incident involved information maintained in a healthcare operations database. Regulatory records published on October 30, 2026, identify 234,534 affected Texas residents and 29,075 affected Massachusetts residents. These state counts are included in the nationwide total. Sources: Texas Attorney General; Massachusetts Data Breach Notifications; Marathon Health Massachusetts Data Breach Notification Sample Letter

According to Marathon’s notification letter, an unauthorized person impersonated a Marathon IT worker and obtained an employee’s account credentials. The person used those credentials to enter a cloud application and export information. Marathon says the access and export occurred within a few hours on August 24, 2026. The notice does not identify the application provider or describe the incident as ransomware. Source: Marathon Health Massachusetts Data Breach Notification Sample Letter

Marathon received a suspicious activity alert involving the employee account on August 24, 2026. The company says it immediately disabled the account and engaged cybersecurity professionals to investigate. On September 9, 2026, Marathon confirmed that the unauthorized person had obtained personal information. The August alert and September confirmation represent different stages of the company’s response. Source: Marathon Health Massachusetts Data Breach Notification Sample Letter

The sample notification letter identifies names, dates of birth, contact information, and Social Security numbers as potentially involved, depending on the individual. The Texas filing also lists medical information and health insurance information. The public records do not establish that every affected person had every listed category exposed, and they do not specify which medical or insurance details were involved. Sources: Texas Attorney General; Marathon Health Massachusetts Data Breach Notification Sample Letter

Marathon says it implemented additional safeguards and plans further measures to protect and monitor its systems. The company is offering complimentary services through Epiq Monitoring Solutions, including credit monitoring, fraud consultation, and identity restoration. Although the letter states that Marathon has no evidence of misuse, it also confirms that an unauthorized person obtained personal information. Source: Marathon Health Massachusetts Data Breach Notification Sample Letter

How did the Marathon Health data breach occur?

The Marathon Health data breach occurred after someone impersonated a company IT worker and obtained an employee’s credentials. The unauthorized person used those credentials to access a cloud application and export information from a healthcare operations database. Marathon disabled the employee account after receiving an alert about suspicious activity. Source: Marathon Health Massachusetts Data Breach Notification Sample Letter

When did the Marathon Health data breach occur?

The unauthorized access and export occurred within a few hours on August 24, 2026. Marathon detected suspicious account activity that day and confirmed on September 9, 2026, that personal information had been obtained. Texas and Massachusetts regulatory records concerning the incident are dated October 30, 2026. Sources: Texas Attorney General; Massachusetts Data Breach Notifications; Marathon Health Massachusetts Data Breach Notification Sample Letter

How many people were affected by the Marathon Health data breach?

Marathon Health reported 5,684,735 affected people nationwide in its Texas Attorney General filing, including 234,534 Texas residents. Massachusetts separately reported 29,075 affected residents. A complete breakdown for other states was not verified in the records reviewed. The Texas and Massachusetts figures are subsets of the nationwide total. Sources: Texas Attorney General; Massachusetts Data Breach Notifications; Marathon Health Massachusetts Data Breach Notification Sample Letter

What information was exposed in the Marathon Health data breach?

• Marathon’s sample notification letter states that the information potentially involved varies by person and may include names, dates of birth, contact information, and Social Security numbers. The company confirmed that an unauthorized person obtained personal information, but the public template does not identify the exact combination of information involved for each recipient. The Texas Attorney General filing additionally identifies medical information and health insurance information. Massachusetts also identifies medical records and Social Security numbers as involved. These records support including those categories in a description of the breach, but they do not establish that particular diagnoses, prescriptions, treatment histories, or insurance policy numbers were exposed. Depending on the individual, information involved may have included:
  • Names
  • Dates of birth
  • Contact information, including addresses
  • Social Security numbers
  • Medical information or records
  • Health insurance information
  Sources: Texas Attorney General; Massachusetts Data Breach Notifications; Marathon Health Massachusetts Data Breach Notification Sample Letter

Has Marathon Health offered free credit monitoring and/or identity theft protection services?

Yes. Marathon’s notification letter offers complimentary Epiq Monitoring Solutions services, including credit monitoring, fraud consultation, and identity restoration. The public template leaves the coverage term as “12/24” months and does not supply a final enrollment deadline. Recipients should consult their individual letters for their coverage period, activation code, and deadline. Source: Marathon Health Massachusetts Data Breach Notification Sample Letter

Marathon Health Data Breach Timeline

Date	Event
August 24, 2026	A person impersonating Marathon IT staff obtained employee credentials, accessed a cloud application, and exported information within a few hours.
August 24, 2026	Marathon received a suspicious activity alert, disabled the employee account, and began an investigation with cybersecurity professionals.
September 9, 2026	Marathon confirmed that the unauthorized person obtained personal information.
October 30, 2026	Texas published Marathon’s filing reporting 5,684,735 affected people nationwide, including 234,534 Texans. Massachusetts recorded a report involving 29,075 residents. Sources: Texas Attorney General; Massachusetts Data Breach Notifications; Marathon Health Massachusetts Data Breach Notification Sample Letter

Who is Marathon Health?

Marathon Health, LLC is a healthcare provider that works with employers, public agencies, unions, and health plans to deliver primary care to employees and eligible family members. Its services include preventive care, management of chronic conditions, mental health care, occupational health, pharmacy services, and care navigation. Marathon provides care through health centers at or near workplaces, shared network locations, and virtual appointments. The company maintains an office in Indianapolis, Indiana, and reports operating more than 720 health centers across 41 states, based on company figures dated May 2026. Sources: Marathon Health; Marathon Health: About Us

What should you do if you received a Marathon Health data breach letter?

• • Read and keep the notification. Review the letter for information about what was involved and any enrollment instructions. Keep the notice, envelope, and related correspondence. For incident questions, the letter lists 888-517-6416, Monday through Friday, 9 a.m. to 9 p.m. Eastern Time, excluding holidays. Source: Marathon Health Massachusetts Data Breach Notification Sample Letter
  • Consider activating the free monitoring services. Follow the instructions in the individual notice and enroll before its deadline. Marathon directs recipients to Epiq Monitoring Solutions and provides a personal activation code. The letter lists enrollment assistance at 866-675-2006, Monday through Friday, 9 a.m. to 5:30 p.m. Eastern Time. Check the individual letter for the coverage period. Source: Marathon Health Massachusetts Data Breach Notification Sample Letter
  • Consider freezing credit with all three major credit bureaus. A freeze limits access to a credit report and makes it harder for someone to open credit accounts using stolen information. Freezes are free to place and lift, and each bureau—Equifax, Experian, and TransUnion—must be contacted separately. A free initial fraud alert is another option; contacting one bureau is sufficient to alert all three, and the alert lasts one year. Source: FTC: Credit Freezes and Fraud Alerts
  • Review credit reports and financial statements. Check for unfamiliar accounts, inquiries, charges, or changes to personal details. Free credit reports are available through AnnualCreditReport.com. Promptly report suspicious activity to the relevant bank, creditor, or credit bureau. Monitoring can help identify certain warning signs, but it does not replace reviewing accounts and statements. Sources: FTC: Credit Freezes and Fraud Alerts
  • Check medical bills and insurance statements. Because regulatory filings identify medical and insurance information as involved, review explanations of benefits and healthcare bills for services or prescriptions not received. Contact the insurer or provider about discrepancies, request relevant records, and seek correction of inaccurate medical information. A credit freeze does not prevent someone from misusing health insurance information. Sources: U.S. Department of Health and Human Services Office of Inspector General: Medical Identity Theft
  • Be cautious about unexpected messages seeking more information. Do not provide Social Security numbers, insurance details, passwords, or payment information to someone who unexpectedly calls, texts, or emails about the incident. Verify requests through a known website or independently confirmed telephone number. Source: U.S. Department of Health and Human Services Office of Inspector General: Medical Identity Theft
  • Act promptly if identity theft appears. Report identity theft through IdentityTheft.gov, contact affected financial institutions or healthcare providers, and dispute inaccurate records. Keep copies of reports, correspondence, expenses, and recovery steps. These records can help with account corrections and document the effects of any misuse. Sources: FTC Consumer Advice: Identity Theft

Marathon Health Data Breach Notice

The notice describes the Marathon Health data breach, including the type of information that may have been involved and the steps offered to affected individuals.

Open the Marathon Health Data Breach Notice in a New Tab

Sources & Additional Information About the Marathon Health Data Breach

• • Marathon Health Website
  • Marathon Health Massachusetts Data Breach Notification Sample Letter
  • Texas Attorney General
  • Massachusetts Data Breach Notifications
  • FTC: How To Recognize and Avoid Phishing Scams
  • my Social Security
  • Medicare.gov: Reporting Medicare fraud & abuse
  • FTC: Checking Your Credit Report
  • FTC: Credit Freezes and Fraud Alerts
  • AnnualCreditReport.com
  • FTC Consumer Advice: Identity Theft
  • IdentityTheft.gov
  • IRS Identity Theft Guide for Individuals
  • IRS Identity Theft Guide Central
  • IRS: Get an identity protection PIN (IP PIN)
  • U.S. Department of Health and Human Services Office of Inspector General: Medical Identity Theft
  • IdentityTheft.gov: What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach

Class Action FAQ

About This Data Breach Resource

This page was created to give affected individuals and researchers a clear, comprehensive explanation of the Marathon Health data breach. It summarizes what is currently known about the incident, including the timeline, how the breach was discovered, the types of information involved, the number of people affected when available, important notice dates, and steps individuals may want to take after receiving a data breach notification.

This resource is independently written and organized to help readers understand the breach without having to review multiple notices, state attorney general filings, company statements, and related materials. When available, this page relies on primary sources and identifies key facts, unanswered questions, and updates as new information becomes public.

This page is especially relevant for readers searching for information about the Marathon Health data breach, Marathon Health data breach notice, Marathon Health class action investigation, what information was exposed, how many people were affected, and what affected individuals should do next.

Abington Cole + Ellery reviews data breach incidents involving sensitive personal information, financial information, and protected health information. This page is intended to help affected individuals understand the publicly reported facts, the types of information that may have been involved, and practical steps that may reduce the risk of identity theft or medical identity theft.

The information on this webpage is provided for general informational purposes only and does not constitute legal advice. Nothing on this page should be relied upon as legal advice for any particular situation. Submitting information through this page does not create an attorney-client relationship.

For more information about steps you can take to possibly reduce the risk harm arising from a data breach, please review the following article: What are some steps you can take if you've been the victim of a data breach?

This website is not associated with nor authorized by Marathon Health or any affiliated companies. If you have received any other data breach notifications, you may want to review Abington Cole + Ellery's current list of data breach investigations.