Marathon Health says a caller posing as an IT worker got into its systems. Letters are going out to up to 5.7 million people, many of whom never visited a clinic.
Marathon Health, a company that runs workplace clinics for employers and unions, has told state officials that a data breach may affect almost 5.7 million people. Names, birth dates and Social Security numbers were taken. You could get a letter even if you never set foot in one of its clinics.
On August 24, 2026, Marathon Health spotted suspicious activity on an employee account. It disabled the account and opened an investigation. The company learned that someone had posed as a Marathon IT worker and tricked the employee into handing over a login. That login opened a cloud-hosted application, and the intruder copied data out of it in a few hours that same day.
Marathon Health finished reviewing the affected data on September 9. Letters to California residents list names, contact information, dates of birth and Social Security numbers. Texas and Vermont state websites also say medical information and health insurance information were exposed.
Marathon Health is based in Indianapolis. It says it serves more than 600 employers, labor unions and public sector groups, with more than 720 health centers in 41 states. The company receives details on everyone enrolled in a client's health plan. It uses them to verify coverage, explain benefits, bill insurers and book appointments.
That is why people who never used a clinic may be on the list. Indiana University, a client, told employees and family members on two Anthem PPO plans that they could use Marathon centers. The company then received some of their information. A letter may come from a company you have never heard of.
The count is not settled. A law firm, Emery Reddy, reports that Texas was told 5,684,735 people are being notified. Texas's own website lists 234,534 Texans. Massachusetts reports 29,075 residents and Vermont 8,858. The breach was not yet on the federal health privacy breach list at the time of reporting. If the 5.7 million figure holds, it would be the fourth-largest healthcare breach of the year.
Expect more scam attempts. A stolen Social Security number plus medical details gives criminals material to sound convincing. Be wary of unexpected calls, texts or emails about your health plan or your credit, even if they mention real details about you.
Marathon Health began mailing letters on October 20, 2026. It is offering 12 or 24 months of free credit monitoring. The alert box above lists the steps to take.
No hacking group or ransomware gang has claimed the attack. The trick used, posing as IT staff to get a login, is also used by groups such as ShinyHunters and Scattered Spider. Whether the final victim count changes should become clearer as more states and federal regulators publish figures.
If a Marathon Health letter arrives, treat it as real, use the free credit monitoring, and guard your Social Security number.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
