What happened in the Quantum Health data breach?

Quantum Health, Inc. recently disclosed a data breach involving unauthorized access to its information technology network and the acquisition of files containing personal and health-related information. The incident began on May 29, 2026, when a Quantum Health employee responded to a voice-phishing call. This type of attack, commonly called “vishing,” uses telephone impersonation or spoofing to persuade a person to disclose credentials or provide access to protected systems. Quantum Health has not publicly explained what information the employee provided, how the attacker used it, or whether any security controls were bypassed.

The unauthorized party remained active in certain Quantum Health systems from May 29 through June 1, 2026. During that period, the intruder accessed and acquired files from the company’s network. Quantum Health discovered the incident on June 1 after a service outage disrupted the availability of certain internal and external systems. The company then secured and isolated its systems, engaged third-party forensic specialists, began restoration efforts, and reported the incident to federal law enforcement. Neither the notification letter nor Quantum Health’s public statement identifies the attacker, describes the event as ransomware, or indicates whether a ransom demand was made. Quantum Health Data Security Incident Notice - July 31, 2026 and California Quantum Health Submitted Breach Notification Sample

Quantum Health’s forensic investigation determined on July 8, 2026, that some of the acquired files contained personal information. According to the consumer notification, Quantum Health began notifying the employer health plans it serves on July 27. The company’s public timeline states that notification letters were mailed to affected individuals on July 31, 2026. Because Quantum Health provides healthcare navigation and care coordination services to employers with self-insured health plans, affected individuals may have received a notice even if they did not knowingly provide information directly to Quantum Health.

The information involved varies by person. The compromised files contained individuals’ names together with one or more types of health insurance information, including policy numbers and claims or benefits information. The files also may have included medical information, treatment details, diagnoses, prescriptions, healthcare-provider names, dates of service, dates of birth, email addresses, mailing addresses, telephone numbers, and demographic information. Quantum Health further stated that, for some individuals, Social Security numbers may also have been involved. A recipient’s individual notice should identify the categories of information associated with that person.

The materials reviewed do not provide a nationwide total for the Quantum Health data breach. However, the Board of Pensions of the Presbyterian Church (U.S.A.), one of the health-plan organizations that used Quantum Health, reported that data belonging to approximately 16,000 of its Medical Plan members was accessed. That figure concerns only the Board’s plan members and should not be treated as the total number affected across all Quantum Health clients. The Board also reported that Quantum Health provided it with a preliminary investigation report on June 9 and engaged CrowdStrike and MOXFIVE in connection with its cybersecurity response. Board of Pensions of the Presbyterian Church (U.S.A.) Quantum Health data security incident

In response to the incident, Quantum Health says it restored its systems, strengthened existing security protocols, and implemented additional safeguards. The company is offering affected individuals complimentary identity-monitoring services through Kroll, including credit monitoring and identity-theft assistance. The enrollment period and activation deadline are provided in each recipient’s individual notification letter. Quantum Health also states that it presently has no evidence that the affected information has been publicly posted or exposed on the Internet, although that statement does not alter its finding that an unauthorized party accessed and acquired files from its systems. Individuals with questions may contact Quantum Health’s incident-response center at (844) 958-8913, Monday through Friday, from 9:00 a.m. to 6:30 p.m. Eastern Time.

How did the Quantum Health breach occur?

The Quantum Health data breach began with a voice-phishing attack, commonly called “vishing.” On May 29, 2026, a caller impersonated a trusted person or organization, and a Quantum Health user responded to the fraudulent call. The interaction enabled an unauthorized party to access Quantum Health’s information technology network. Quantum Health Data Security Incident Notice - July 31, 2026

When did the Quantum Health breach occur?

The Quantum Health data breach reportedly took place on or around between May 29 and June 1, 2026.

How many people were affected by the Quantum Health breach?

As of August 16, 2026, Quantum Health has not publicly disclosed the nationwide number of people affected. The largest confirmed partial figure is approximately 16,000 affected members of the Board of Pensions of the Presbyterian Church (U.S.A.). That represents only one health plan using Quantum Health, not the entire breach population.

What information was exposed in the Quantum Health breach?

• The information exposed in the Quantum Health data breach varied by individual. According to Quantum Health’s consumer notification, the compromised files contained names together with one or more of the following:
  • Health insurance policy numbers
  • Claims and benefits information
  • Medical and treatment information
  • Diagnoses
  • Prescription information
  • Healthcare-provider names
  • Dates of service
  • Dates of birth
  • Email addresses
  • Mailing addresses
  • Telephone numbers
  • Demographic information
  • Social Security numbers

Has Quantum Health offered free credit monitoring and/or identity theft protection services?

Yes. Quantum Health offered affected individuals complimentary identity-monitoring services through Kroll, including single-bureau credit monitoring, dark-web monitoring, fraud consultation, and identity-theft restoration. Enrollment requires the activation code and verification ID provided in each individual notice and must be completed by the letter’s deadline. The duration may vary by recipient.

Quantum Health data breach timeline:

Date	Event
May 29, 2026	A Quantum Health user responded to a voice-phishing—or “vishing”—call, allowing an unauthorized party to gain access to Quantum Health’s information-technology network.
May 29–June 1, 2026	The unauthorized party accessed Quantum Health’s network and acquired files from certain company systems.
June 1, 2026	Quantum Health detected a service outage affecting certain internal and external systems. The company secured and isolated its systems, began restoration efforts, and launched an investigation with third-party forensic specialists.
July 8, 2026	Quantum Health determined that some of the acquired files contained individuals’ personal and protected health information.
July 30, 2026	Quantum Health reported the breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The company also began notifying affected individuals and offered complimentary Kroll identity-monitoring services, including credit monitoring, fraud consultation, and identity-theft restoration.

Who is Quantum Health?

Quantum Health, Inc. is a healthcare navigation and care coordination company founded in 1999 and headquartered in Dublin, Ohio. The company works with employers and their health-plan members, helping individuals understand their benefits, address claims and billing questions, locate in-network providers, and coordinate care and coverage requirements. Quantum Health is not a health insurance company; instead, it serves as a centralized resource connecting members with benefits information, clinical guidance, and healthcare support. About Quantum Health

What should you do if you received a Quantum Health data breach letter?

• If you received a Quantum Health data breach notification letter, you should take the incident seriously because the compromised information may include sensitive medical, health-insurance, contact, and identity-related information. Consider taking the following steps:
  • Review and retain the notification letter. Determine which categories of your information were affected and keep the letter in a secure place. It contains the activation code, verification ID, enrollment deadline, and duration of the complimentary Kroll services available to you.
  • Enroll in the complimentary Kroll identity-monitoring services. Quantum Health is offering affected individuals credit monitoring, fraud consultation, and identity-theft restoration at no cost. Enrollment is not automatic, so use the instructions in your letter before the stated deadline. Because the duration varies among recipients, consult your individual notice for the applicable coverage period.
  • Consider freezing your credit reports. If your Social Security number was involved, place a free security freeze with Equifax, Experian, and TransUnion. A credit freeze can help prevent someone from opening a new account in your name and does not affect your credit score. You must contact all three bureaus separately. FTC: Credit Freezes and Fraud Alerts
  • Review your credit reports Obtain free credit reports from Equifax, Experian, and TransUnion through AnnualCreditReport.com. Look for unfamiliar accounts, credit inquiries, addresses, or other activity and continue checking your reports regularly.
  • Monitor your healthcare and insurance records.Carefully review medical bills, insurance statements, explanations of benefits, prescription records, and patient-portal activity for services, providers, diagnoses, or claims you do not recognize. Promptly report suspicious activity to your healthcare provider and health insurer.
  • Watch your financial accounts.Review bank and credit-card statements for unauthorized transactions. Credit monitoring generally will not detect fraudulent activity involving an existing bank or credit-card account.
  • Protect your online accounts.Change passwords for sensitive accounts if you reused the same or similar password elsewhere. Use unique passwords and enable multifactor authentication, particularly for your email, financial, healthcare, and insurance accounts.
  • Be alert for phishing and impersonation attempts.Criminals may use exposed contact, medical, or insurance information to make fraudulent calls, emails, or text messages appear legitimate. Do not provide your Social Security number, passwords, activation code, or financial information to an unsolicited caller. Access Kroll’s enrollment portal by using the address printed in your notification letter.
  • Document suspected identity theft and related losses.Preserve suspicious communications, credit reports, bills, account statements, receipts, and records of the time and money spent responding to the breach. If your information is misused, report the identity theft at IdentityTheft.gov to obtain a personalized recovery plan.

Quantum Health Data Breach Notice

The notice describes the Quantum Health data breach, including the type of information that may have been involved and the steps offered to affected individuals.

Open the Quantum Health Data Breach Notice in a New Tab

Sources and additional information about the data breach:

• • Quantum Health Website
  • Quantum Health Data Security Incident Notice - July 31, 2026
  • California Quantum Health Submitted Breach Notification Sample
  • Board of Pensions of the Presbyterian Church (U.S.A.) Quantum Health data security incident
  • FTC: Checking Your Credit Report
  • FTC: Credit Freezes and Fraud Alerts
  • AnnualCreditReport.com
  • FTC Consumer Advice: Identity Theft
  • IdentityTheft.gov
  • IRS Identity Theft Guide for Individuals
  • U.S. Department of Health and Human Services Office of Inspector General: Medical Identity Theft
  • IdentityTheft.gov: What To Do if Your Information Was Lost or Stolen, or Part of a Data Breach

Class Action FAQ

About This Data Breach Resource

This page was created to give affected individuals and researchers a clear, comprehensive explanation of the Quantum Health data breach. It summarizes what is currently known about the incident, including the timeline, how the breach was discovered, the types of information involved, the number of people affected when available, important notice dates, and steps individuals may want to take after receiving a data breach notification.

This resource is independently written and organized to help readers understand the breach without having to review multiple notices, state attorney general filings, company statements, and related materials. When available, this page relies on primary sources and identifies key facts, unanswered questions, and updates as new information becomes public.

This page is especially relevant for readers searching for information about the Quantum Health data breach, Quantum Health data breach notice, Quantum Health class action investigation, what information was exposed, how many people were affected, and what affected individuals should do next.

Abington Cole + Ellery reviews data breach incidents involving sensitive personal information, financial information, and protected health information. This page is intended to help affected individuals understand the publicly reported facts, the types of information that may have been involved, and practical steps that may reduce the risk of identity theft or medical identity theft.

The information on this webpage is provided for general informational purposes only and does not constitute legal advice. Nothing on this page should be relied upon as legal advice for any particular situation. Submitting information through this page does not create an attorney-client relationship.

For more information about steps you can take to possibly reduce the risk harm arising from a data breach, please review the following article: What are some steps you can take if you've been the victim of a data breach?

This website is not associated with nor authorized by Quantum Health or any affiliated companies. If you have received any other data breach notifications, you may want to review Abington Cole + Ellery's current list of data breach investigations.