Marathon Health Data Breach Featured
Personal information, Social Security numbers, and potentially sensitive medical records may have been exposed in a major healthcare data breach.
Marathon Health, a provider of employer-sponsored healthcare, has disclosed a significant data breach reportedly affecting approximately 5.7 million people across the United States. The incident involved personal information held in a healthcare operations database, raising concerns about identity theft and privacy.
You may be affected even if you never visited a Marathon Health clinic. If you received a notification letter, or think your information may have been involved, you can request a confidential review by completing the form on this page.
What Happened in the Marathon Health Data Breach?
On August 24, 2026, Marathon Health detected suspicious activity involving an employee account. According to its breach notification, an unauthorized individual impersonated an IT worker and obtained the employee’s login credentials.
The attacker used those credentials to access a cloud-hosted application and export information within several hours. Marathon Health disabled the account and investigated with cybersecurity professionals. On September 9, it confirmed that the intruder had obtained personal information.
Notification letters began going out in October 2026. State regulatory filings indicate that the incident affected nearly 5.7 million individuals nationwide.
What Personal Information May Have Been Exposed?
The information involved varies by person. Marathon Health’s notification identifies the following types of information:
- Full names
- Dates of birth
- Contact information
- Social Security numbers
State attorney general disclosures also identify medical information and health insurance information among the affected data. This does not mean every person’s records contained all these details.
Marathon Health said it had no evidence that the information had been or would be misused. Still, the exposure of Social Security numbers and potentially sensitive healthcare information can create lasting concerns.
Who May Be Affected?
Marathon Health provides workplace healthcare services through employers, unions, and public organizations. It may hold information about employees and covered family members so they can access healthcare benefits.
Consequently, someone may receive a notification even without having received treatment from Marathon Health. Employees, eligible family members, and others whose information was provided to Marathon Health should review any notice they receive.
Is a Marathon Health Data Breach Class Action Being Investigated?
Attorneys are investigating whether people affected by the Marathon Health data breach may have legal claims. Potential issues include the protection of sensitive information, the consequences of the intrusion, and any losses or other harm experienced by affected individuals.
An investigation does not establish wrongdoing, and compensation is not guaranteed. However, sharing your experience may help determine whether you have a potential claim.
What Should Affected Individuals Do?
If you believe your information was compromised, consider these steps:
- Keep your breach notification letter and any related correspondence.
- Review credit reports and financial accounts for unfamiliar activity.
- Consider placing a free credit freeze with the major credit bureaus.
- Review the complimentary 12- or 24-month monitoring offer described in your notice.
- Watch for suspicious calls, texts, or emails requesting personal information.
Were You Affected by the Marathon Health Data Breach?
If Marathon Health notified you that your information may have been exposed, complete the confidential form on this page to learn whether your circumstances may qualify for further legal review.
There is no cost or obligation to submit the form. You do not need to provide your Social Security number, medical records, or financial account numbers. Taking a moment to share your experience may help you understand your options.