What happened
Marathon Health runs onsite and near-site health clinics that employers, unions and public agencies offer to their workers. It is based in Indianapolis.
According to its notice letters, on August 24, 2026 someone pretending to be a Marathon IT worker got an employee to hand over their login. The attacker used it to get into a cloud-hosted app and exported data from a back-end healthcare operations database, all within a few hours that day. Marathon confirmed on September 9 that personal info was taken.
The company filed notices with state attorneys general on October 30, 2026. The Texas filing lists 5,684,735 people affected in total, including 234,534 Texans. Letters are going out by mail.
What data was exposed
It varies by person. Across the Texas, Vermont and Massachusetts filings, the info listed is:
- 01Names
- 02Addresses and contact info
- 03Dates of birth
- 04Social Security numbers
- 05Medical information
- 06Health insurance information
What to do now
The filings do not mention bank account or card data.
- 01Freeze your credit at Equifax, Experian and TransUnion. SSN plus date of birth is what people need to open accounts in your name. A freeze is free and you can lift it whenever you apply for something.
- 02Get an IRS Identity Protection PIN at IRS.gov so nobody can file a tax return with your SSN.
- 03Read your insurance EOBs (explanation of benefits). With insurance and medical info out there, medical identity theft is the risk people miss. Flag any visit, prescription or provider you do not recognize to your insurer.
- 04Be careful with calls and texts about your clinic or benefits. The attacker got in by posing as IT staff, so expect the same trick aimed at patients. Call your clinic or HR back on a number you already have.
- 05Sign up for the monitoring in your letter. The Massachusetts letter offers free identity monitoring through Epiq.
How to check if you were in it
If you have used a Marathon Health clinic through your job, union or a public employer, watch your mail. The notice letter is the most reliable way to know.
Have I Been Pwned is free and the best known way to check an email against public breaches. This breach probably will not show up there unless the data gets posted publicly.
OSINT Pro's email lookup checks breach records and stealer logs, which catch passwords stolen by malware on your own device.
OSINT Pro does not have the Marathon Health dataset. If it ever leaks publicly and gets indexed, we will update this page.