INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Marathon Health Breach Exposes 5.7 Million Individuals via Data Leak

| 2026-11-03 11:26 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A substantial data breach reportedly involved the personal and protected health information of almost 5.7 million individuals at Indianapolis, Indiana-based Marathon Health, an employer-sponsored healthcare provider that partners with employers, labor unions, and public sector organizations to provide advanced primary care across the United States. The attack is believed to have occurred on August 24, 2026, when an unauthorized individual posed as a Marathon IT worker and tricked an employee into disclosing their credentials, gaining access to a cloud-hosted application and exporting sensitive information in a matter of hours. This cyber operation type, categorized under social engineering tactics used by initial access brokers such as the ShinyHunters and Scattered Spider threat groups, has not been claimed by either group.
Technical Mitigations AI-generated
• Use multi-factor authentication for employee accounts to prevent social engineering tactics. • Regularly review and patch cloud-hosted applications to prevent unauthorized access. • Implement a robust security awareness training program to educate employees on phishing and impersonation techniques.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Scattered SpiderScattered SpiderShinyHuntersShinyHunters
Target & Sectors
US
legallegal governmentgovernment healthhealth
Incident Timeline
‎August 24, 2026
The credentials provided access to a cloud-hosted application, and the unauthorized individual exported information from that application in the space of a few hours on August 24, 2026.
industry Health
General Document Context
industry Government
General Document Context
industry Legal
General Document Context
threat_actor ShinyHunters
Learn More About This Offer The social engineering tactics – impersonating an IT worker to steal credentials – are used by initial access brokers and several different cybercriminal groups, including the ShinyHunters and Scattered Spider threat groups.
threat_actor Scattered Spider
Learn More About This Offer The social engineering tactics – impersonating an IT worker to steal credentials – are used by initial access brokers and several different cybercriminal groups, including the ShinyHunters and Scattered Spider threat groups.
organisation Cybersecurity Consultation
Avail of a Free 30-Minute Cybersecurity Consultation with Blue Team Alpha Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
‎September 9, 2026
General Document Context Marathon Health’s review of the impacted data was completed on September 9, 2026.
industry Health
General Document Context
industry Government
General Document Context
industry Legal
General Document Context
organisation Marathon Health’s
Marathon Health’s review of the impacted data was completed on September 9, 2026.
organisation Vermont Attorneys General
The websites of the Texas and Vermont Attorneys General also state that medical information and health insurance information were compromised.
‎October 20, 2026
Notification letters were mailed to approximately 5.7 million individuals on October 20, 2026.
industry Health
General Document Context
industry Government
General Document Context
industry Legal
General Document Context
organisation Indiana University
One of the affected clients is Indiana University, which informed employees and family members enrolled in the Anthem PPO HDHP or Anthem PPO $500 Deductible Plan that they are eligible to use Marathon Health centers, and as such, Marathon Health was provided with some of their information.
organisation Anthem PPO
One of the affected clients is Indiana University, which informed employees and family members enrolled in the Anthem PPO HDHP or Anthem PPO $500 Deductible Plan that they are eligible to use Marathon Health centers, and as such, Marathon Health was provided with some of their information.
financial $500
One of the affected clients is Indiana University, which informed employees and family members enrolled in the Anthem PPO HDHP or Anthem PPO $500 Deductible Plan that they are eligible to use Marathon Health centers, and as such, Marathon Health was provided with some of their information.
‎Nov 3, 2026
Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals Posted By Steve Alder on Nov 3, 2026 State attorneys general have been informed about a substantial Marathon Health data breach that reportedly involved the personal…
industry Health
General Document Context
industry Government
General Document Context
industry Legal
General Document Context
tactic Data Breach
Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals Posted By Steve Alder on Nov 3, 2026 State attorneys general have been informed about a substantial Marathon Health data breach that reportedly involved the personal and protected health information of almost 5.7 million individuals.
organisation Marathon Health
Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals Posted By Steve Alder on Nov 3, 2026 State attorneys general have been informed about a substantial Marathon Health data breach that reportedly involved the personal and protected health information of almost 5.7 million individuals.
organisation the HHS’ Office for Civil Rights
As a HIPAA-covered entity, the data breach must be reported to the HHS’ Office for Civil Rights (OCR); however, it is not currently listed on the OCR data breach portal.
organisation OCR
As a HIPAA-covered entity, the data breach must be reported to the HHS’ Office for Civil Rights (OCR); however, it is not currently listed on the OCR data breach portal.
‎2026/11/03
Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals.
organisation Marathon Health Data Breach Reportedly Affects
Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals.
Tactical Metrics
Metrics
financial
$500
Financial Impact
One of the affected clients is Indiana University, which informed employees and family members enrolled in the Anthem PPO HDHP or Anthem PPO $500 Deductible Plan that they are eligible to use Marathon Health centers, and as such, Marathon Health was provided with some of their information.
Intelligence Sources
HIPAA Journal 2026-11-03