A social engineering attack on a workplace healthcare provider has left more than 270,000 employees and their family members facing potential exposure of their most sensitive personal and medical information.
Marathon Health, which operates on-site, near-site, and virtual primary care clinics for employer clients, disclosed a breach, stemming from an August 24 incident. An unauthorized individual posing as a Marathon IT worker obtained an employee’s login credentials and used them to access and export data from a cloud-hosted application.
The intrusion lasted only a few hours, but it took until September 9 to confirm that personal information had actually been obtained. Written notices to affected individuals went out in late October, roughly two months after the breach date, within HIPAA’s 60-day notification window, but a significant interval given that Social Security numbers and health records were among the data at risk.
State attorney general filings confirmed at least 272,467 individuals across 14 states as of October 30, including 234,534 Texas residents, 29,075 in Massachusetts, and 8,858 in Vermont. A confirmed total across all states has not yet been published by Marathon Health or posted to the HHS Office for Civil Rights breach portal, where updates for recently disclosed incidents typically lag by several weeks.
The breach notification letter lists names, dates of birth, contact information, and Social Security numbers as potentially involved data. State AG filings indicate health records and health insurance information may also be in scope for some individuals.
Marathon Health’s position in the employer benefits ecosystem is what makes this breach notable beyond its size. Unlike a health insurer or pharmacy benefit manager sitting at one remove from the employee, Marathon Health operates the actual care delivery relationship. Employees who used an on-site or near-site clinic shared health and identity information directly with a vendor whose data security practices were outside the employer’s control.
The notification letters sent to affected individuals carry the Marathon Health name, not the employer’s. That means the employer client may learn of the breach from the same letter their employees receive.
The mechanism behind the breach is well documented as a leading threat vector. Paubox’s analysis of 2025 HHS breach data found that credential theft via phishing-driven mailbox takeovers exposed more than 630,000 individuals in that year alone, making it the most damaging category of email-based healthcare breach by impact despite accounting for less than 20% of total incidents. The Marathon Health incident falls within the same broad category of credential compromise through impersonation rather than technical exploitation, though the specific vector was IT worker impersonation rather than a phishing email.
The employer did not cause the breach, but employees are receiving notification letters connected to a workplace health benefit. As the surge in healthcare vendor breaches has sharpened scrutiny of what plan sponsors are expected to know about their vendors’ data practices, the Marathon Health incident adds to a growing set of cases where the breach path ran through a third-party care or benefit delivery relationship rather than through the plan itself. The MedImpact PBM breach earlier this year followed the same structure, with affected employees receiving notifications that referenced their employer’s health plan.
Marathon Health is offering 12 to 24 months of complimentary identity monitoring through Epiq Monitoring Solutions, covering credit monitoring, fraud consultation, and identity theft restoration.
