Social Engineering Attack Exposes Data of 270,000 via Marathon Health Breach

• •Over 270,000 individuals affected by the Marathon Health breach.
• •Attack method involved social engineering and credential theft.
• •Sensitive data exposed includes Social Security numbers and health records.

A social engineering attack on Marathon Health has compromised the personal and medical information of over 270,000 individuals, including employees and their family members. The breach occurred on August 24, 2026, when an unauthorized individual impersonating a Marathon IT worker gained access to an employee's login credentials. This allowed the attacker to access and export sensitive data from a cloud-hosted application. The breach was confirmed on September 9, and written notifications were sent to affected individuals in late October, adhering to HIPAA's 60-day notification requirement. The data potentially exposed includes names, dates of birth, Social Security numbers, health records, and health insurance information. State attorney general filings indicate that the breach affected individuals across 14 states, with the largest number in Texas. Marathon Health has not yet published a complete total of affected individuals. The incident highlights vulnerabilities in the vendor model of healthcare delivery, where data security practices are outside the employer's control.