Marathon Health breach exposes personal and health data of more than 270,000 people

On 30 October 2026, Marathon Health — a U.S. provider of employer-sponsored primary care that operates health centres and virtual-care services for businesses and their employees across the country — began notifying regulators and affected individuals of a data breach that exposed the personal and health information of more than 270,000 people. According to filings reported from several states, the compromise stemmed from a social-engineering attack in which an intruder posing as a Marathon Health IT worker tricked an employee into handing over their login credentials.

How the attack unfolded

Marathon Health said it received an alert about suspicious activity on an employee's account on 24 August 2026 and disabled the account. A subsequent investigation found that the attacker had used the stolen credentials to reach a cloud-hosted application and export data. By 9 September 2026, the company had confirmed that personal information belonging to individuals in its systems had been obtained by the unauthorised party. The help-desk impersonation technique at the centre of the incident has become a recurring theme in recent intrusions, where attackers bypass technical controls by persuading a person to surrender access rather than exploiting software.

What was exposed

The data involved varies by individual but, according to the state-filing summaries, may include names, dates of birth, addresses and contact information, Social Security numbers, medical records and other health information, and health insurance details. Because Marathon Health delivers clinical care, the exposure spans both conventional identity data and protected health information, raising the risk of identity theft and insurance fraud for those affected.

Scale and response

Regulatory filings list at least 234,534 affected people in Texas, 29,075 in Massachusetts and 8,858 in Vermont — a combined total of more than 272,000 — and notifications were also lodged with attorneys general in a number of other states, so the full figure may be higher. Marathon Health said it had disabled the compromised account, investigated the scope of the access, and begun mailing written notices to affected individuals. The company, which absorbed on-site clinic operator Everside Health in a 2024 merger, faces scrutiny from plaintiffs' firms that announced investigations into potential class-action claims within days of the disclosure.