Marathon Health Data Breach

Marathon Health, which runs health centers that employers offer to their workers, has reported a data breach affecting 5,684,735 people. State filings list Social Security numbers and health records among the exposed data.

Marathon Health reported the breach to the Texas Attorney General, listing 5,684,735 people affected in total, including 234,534 Texans. The Vermont Attorney General posted the breach on Oct. 30, 2026, listing 8,858 Vermont residents and identifying Social Security numbers and health records as the data involved. A Massachusetts filing lists Social Security numbers and medical information.

Marathon Health provides primary care through on-site and near-site health centers that employers set up for their employees and families. Indiana University, one of the employers that uses Marathon Health, told its plan members on Oct. 15, 2026, that Marathon Health had notified the university of a data security incident involving information in one of its databases.

Emery | Reddy is investigating the Marathon Health data breach on behalf of people who may be affected.

Plan Members May Be Affected Without Ever Visiting a Clinic

One detail sets this breach apart. According to Indiana University’s notice to its employees, people may be affected even if they never received care from Marathon Health. The university explained that Marathon Health keeps information on all enrolled plan members so it can verify coverage, share benefit information, schedule appointments and bill insurance.

That means many people affected by this breach may not know they had a relationship with Marathon Health at all. For them, the first sign may be a letter in the mail.

When Notices Went Out

Indiana University told plan members that Marathon Health would begin mailing notice letters directly to affected people on Oct. 20, 2026. State regulators posted the breach on Oct. 30, 2026. Marathon Health has not publicly announced when the breach happened or when it was discovered.

What Information Was Exposed?

According to the Vermont and Massachusetts filings, the exposed information includes:

• Social Security numbers
• Health records and medical information

Indiana University says the information involved varies by person. Each notice letter should state what was involved for that individual.

What Is Marathon Health Offering?

According to Indiana University, Marathon Health is offering complimentary identity monitoring services and has set up a dedicated support center. The details, including the monitoring vendor, how long the service lasts and how to enroll, are in each notice letter. Marathon Health has not published those details.

Social Security Numbers Plus Health Records Is a Dangerous Mix

A Social Security number can be used to open credit, file a fake tax return or apply for benefits in someone else’s name. Health records add a second layer of risk. Criminals can use medical and insurance details to get care or prescriptions under another person’s name, which is called medical identity theft. Medical identity theft can leave false entries in a person’s health records and bills they never ran up.

Steps that reduce the risk:

• Enroll in the identity monitoring offered in the notice letter
• Place a free security freeze with Equifax, Experian and TransUnion
• Review explanation of benefits (EOB) statements from the health plan for care that was never received
• Request a copy of medical records if anything looks wrong
• File taxes early and consider an IRS Identity Protection PIN

Do You Have Legal Options?

Healthcare providers that collect Social Security numbers and medical information have a duty to protect it under federal and state law. When that duty is not met, affected people may have legal rights and remedies worth discussing with an attorney.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. No Fee Unless We Recover.

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Frequently Asked Questions

How many people were affected by the Marathon Health data breach?

Marathon Health reported 5,684,735 people affected in total to the Texas Attorney General, including 234,534 Texans. Vermont lists 8,858 of its residents.

What information was exposed?

According to the Vermont and Massachusetts filings:

• Social Security numbers
• Health records and medical information

Your notice letter should say exactly what was involved for you.

I never went to a Marathon Health clinic. Could I still be affected?

Yes, possibly. Indiana University told its employees that Marathon Health keeps information on all enrolled plan members, not just patients. If your employer’s health plan used Marathon Health, watch your mail for a letter.

What should I do if I received a Marathon Health letter?

Act soon, because monitoring offers usually have an enrollment deadline:

• Enroll in the free identity monitoring described in the letter
• Freeze your credit with all three bureaus
• Check your health plan statements for care you did not receive
• Watch for tax and benefits fraud in your name

How can medical data be misused?

Medical and insurance information can be used to get care, prescriptions or equipment in your name, or to file false insurance claims. This can put wrong information in your medical record and leave you with bills or a used-up benefit limit. Review your health plan statements regularly.

How can I avoid scams that mention this breach?

Scammers often contact breach victims pretending to be the company or a monitoring service. Do not give your Social Security number or insurance details to anyone who calls or emails you out of the blue. Use only the phone number or website printed in your official letter.

Do I have a legal claim?

Healthcare organizations have a duty to protect patient and member information and to notify people promptly when it is exposed. If your information was involved in the Marathon Health data breach, you may have legal rights. Contact Emery | Reddy at 916.995.5968 or visit emeryreddy.com for a Free Case Review to see what you may qualify for. No Fee Unless We Recover.