Marathon Health data breach investigation (August 2026 incident)

Marathon Health, a company that runs employer-sponsored health centers, is mailing data breach letters after an intruder exported personal information from one of its systems on August 24, 2026. Marathon's sample letter says the information varied by person and may have included names, dates of birth, contact information and Social Security numbers. State filings also list medical and health insurance information.

The scale is large. Breach trackers and law firms that reviewed Marathon's October 30, 2026 report to the Texas Attorney General say it lists 5,684,735 people affected nationwide, including 234,534 Texans. Vermont's public list shows 8,858 Vermont residents, and Massachusetts filings show 29,075 residents.

Several law firms are now investigating possible class action claims. As of November 1, 2026, Class Action Pulse found no filed lawsuit, no settlement and no claim form. This page explains what Marathon has said, who may be affected and what readers can do now.

Marathon Health says it provides on-site, near-site and virtual health care to employees, and their family members, of various organizations. Law firm summaries list Marathon Health, LLC in Indianapolis, Indiana, and describe hundreds of health centers across dozens of states. Employers and health plans offer these centers as a workplace benefit.

Affected people are those whose information sat in what Marathon calls one of its "back-end health care operations databases." Indiana University told its employees that Marathon keeps information on all members enrolled in the plans it serves so it can verify coverage, share benefit information, schedule appointments and bill insurance. That means a person may be affected even without ever visiting a Marathon clinic.

Law firms including Dapeer Law, Emery Reddy, Shamis & Gentile, Murphy Law Firm and Abington Cole + Ellery have posted investigation pages. Those pages are lawyer advertising, not court filings.

According to Marathon's sample letter filed with Massachusetts regulators:

• On August 24, 2026, Marathon received an alert of suspicious activity on an employee's account and disabled the account.
• An unauthorized person posing as a Marathon IT worker had obtained the employee's login credentials.
• The person used those credentials to access a cloud-hosted application and exported information. Marathon says all of this happened within a few hours on August 24.
• On September 9, 2026, Marathon validated that personal information was obtained by the unauthorized person.

Marathon does not name the cloud application or say whether a ransom demand was made. The breach was posted by the Texas, Vermont and Massachusetts regulators on October 30, 2026. Indiana University said in an October 15 notice that direct letters to affected members would begin October 20.

Marathon says it takes the matter very seriously, has added safeguards and will keep adopting more. Its letter states that it does not have evidence the information was or will be misused. Marathon is offering free identity monitoring through Epiq Monitoring Solutions for 12 or 24 months, depending on the letter.

The investigating law firms say they are examining whether Marathon adequately protected the data, and whether affected people can seek compensation. They have not proven any claim. No court has reviewed these questions.

No court has decided anything because no lawsuit had been found as of November 1, 2026. There is no class, no settlement and no ruling on whether Marathon was negligent. If a case is filed, it would start with allegations that Marathon could contest.

The group most likely to matter in a future case is people who receive a Marathon Health breach letter about the August 24, 2026 incident. That can include current or former patients and members of employer or university health plans that use Marathon centers, even if they never received care there.

Your letter is the best evidence of what applies to you. The listed data categories are not the same for everyone.

1. Keep your letter and envelope. They show that Marathon notified you and which details it listed.
2. Enroll in the free monitoring. Use the activation code in your letter at epiqmonitoringsolutions.com before the deadline shown in the letter.
3. Consider a credit freeze. If your Social Security number was involved, a free freeze at Equifax, Experian and TransUnion can block new credit in your name.
4. Watch health and insurance records. Review explanation of benefits statements for care you did not receive.
5. Treat contact about the breach with caution. Scammers often call or text about real breaches. Use phone numbers printed in your letter.
6. Write down any harm. Keep notes on fraud, costs and time spent responding.

Right now the only benefit is the Epiq monitoring package. The letter says it includes one-bureau credit monitoring, basic dark web monitoring, help placing credit freezes, change-of-address monitoring and identity restoration help.

Nothing else is available. If a lawsuit is filed and later settles, past data breach settlements have sometimes offered reimbursement for documented losses, payment for lost time, extra monitoring or a cash payment. Those terms vary widely, and none exist for this incident.

• August 24, 2026: Suspicious activity alert and data export, per Marathon.
• September 9, 2026: Marathon confirmed personal information was taken.
• October 20, 2026: Indiana University said letters to its members would begin.
• October 30, 2026: Texas, Vermont and Massachusetts postings.
• Enrollment deadline: Printed in your letter. The public sample shows it only as a placeholder.

You do not lose any right by enrolling in monitoring. Contacting a law firm is optional and does not make you part of any case.

• Data breach investigation: A law firm review of whether a company may be legally responsible for a breach. It is not a lawsuit.
• Credential theft: Stealing a username and password, here allegedly by pretending to be IT staff.
• Near-site clinic: A health center near a workplace that serves several employers or plan members.
• Credit freeze: A free block that stops most lenders from viewing your credit file.

Lawsuits often follow breaches of this size within weeks of notice letters. If one is filed, it may name a proposed class of people who got letters, and more cases may be combined later. Class Action Pulse will update this page if a complaint, a fuller Marathon statement or a regulator record adds detail.

This page relies on Marathon's sample notice letter filed with Massachusetts, Vermont's public breach list and Indiana University's notice. The nationwide and Texas totals come from breach trackers and law firm pages that cite Marathon's Texas filing, because the Texas portal could not be read directly. Marathon has not published a press release that Class Action Pulse could find. Health center counts are company figures repeated by law firms.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.