Marathon Health says a caller posing as IT got in, in a breach reported at about 5.7 million people

Marathon Health runs health centres for employers in the United States: clinics on or near a workplace, plus virtual care, offered to staff and their families as a work benefit. It is now sending letters about a data theft that started with a single tricked employee. State filings put the number of people being notified at about 5.7 million, which The HIPAA Journal says would make it the fourth-largest breach reported by a U.S. health care organization covered by HIPAA this year. You may get a letter even if you’ve never been a Marathon patient. Here’s what the company has said and what you can do.

What happened

In the notification letter Marathon filed with the California Attorney General, the company says it received an alert on August 24, 2026 about suspicious activity on one of its employees’ accounts. It disabled the account and started an investigation with outside cybersecurity professionals. That investigation found that “an unauthorized individual posing as a Marathon IT worker was able to obtain the employee’s credentials, used those credentials to access a cloud-hosted application, and exported information during that access.” Marathon says this all happened within a few hours on August 24. On September 9, it confirmed that personal information had been taken.

The letter describes the data as coming from “one of our back-end health care operations databases.” Marathon hasn’t said which cloud application was used or who was behind it. BankInfoSecurity reports that the extortion group ShinyHunters hadn’t listed Marathon as a victim on its site as of November 2, and The HIPAA Journal found no group claiming the attack.

What was taken

According to the letter, the information “varied by individual” and may have included:

• name
• date of birth
• contact information
• Social Security number

The HIPAA Journal reports that the Texas and Vermont attorney general listings also include medical information and health insurance information. Marathon’s own letter doesn’t mention diagnoses or treatment, so if you get one, read it closely for the categories that apply to you.

Who is affected

The numbers come from state filings. Massachusetts was told 29,075 of its residents were affected, Vermont 8,858 and Texas 234,534, according to The HIPAA Journal and BankInfoSecurity. Both outlets also cite the law firm Emery Reddy as saying Marathon told Texas that 5,684,735 people in total are being notified. Marathon hasn’t confirmed that total publicly, and the breach wasn’t yet on the U.S. Department of Health and Human Services’ public breach portal when they reported. Letters started going out on October 20.

The reason so many people are included is how the benefit works. To check coverage, schedule appointments and bill insurers, Marathon is given information on everyone enrolled in an eligible employer plan, not just people who visit a clinic. Indiana University, one of its clients, told staff in an October 15 notice that people enrolled in certain university medical plans could be affected “even if they have never received care from Marathon Health,” BankInfoSecurity reports. If your employer, union or public employer offers Marathon clinics, you may be in the data even if the name means nothing to you.

What Marathon is offering

Marathon is offering 12 or 24 months of free identity monitoring through Epiq Monitoring Solutions, which includes credit monitoring, dark web monitoring and help with identity theft recovery. Each letter has its own activation code and enrolment deadline. Marathon says it doesn’t have evidence the information was or will be misused, and that it has added safeguards. Its call centre for this incident is 888-517-6416, Monday to Friday, 9 AM to 9 PM Eastern time.

How this fits a wider pattern

Phoning an employee while pretending to be from IT is one of the most common ways into companies this year. We explained how those calls work, and why your data gets caught up even though you never got the call. The same approach was behind the recent break-ins at several large Canadian law firms. BankInfoSecurity notes that the Health Information Sharing and Analysis Center warned its members in September about a rise in these schemes against health care organizations, many of them involving voice phishing. There is no public evidence linking Marathon’s breach to any of those other cases.

What you can do

1. Read your letter carefully and note which information it lists for you. If you aren’t sure a letter is real, call the number printed in Marathon’s filing (888-517-6416) rather than one in an email or text.
2. Activate the monitoring before your deadline, using the code in the letter. It’s free and doesn’t affect your credit score.
3. Consider a credit freeze with Equifax, Experian and TransUnion. With a Social Security number and date of birth exposed, a freeze is the strongest protection against new accounts being opened in your name, and it’s free.
4. Watch your insurance statements (explanation of benefits) for visits or prescriptions you don’t recognize, and report them to your insurer.
5. Be careful with calls and emails about this breach, especially ones offering to “help” for a fee or asking you to confirm your Social Security number. Marathon’s letter doesn’t ask you to give it anything.
6. Learn the patterns. See how scammers use leaked data.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases let you give each company or sign-up its own address, so one leak doesn’t reach everything. Frame never collects or stores the leaked records themselves.

Related coverage

• The phone call behind 2026’s biggest breaches: how callers posing as IT staff get in, and what stops them.
• Callers posing as IT got into at least four Canadian law firms: the same method, used against firms holding client files.

Sources

• Marathon Health, notification letter filed with the California Attorney General, October 2026 (listing)
• The HIPAA Journal, Marathon Health Data Breach Reportedly Affects 5.7 Million Individuals, November 3, 2026
• BankInfoSecurity, Marathon Health Hack Reportedly Affects Nearly 5.7 Million, November 2, 2026