Marathon Health Breach: 5.7 Million and a Fake IT Worker

Note: This post was written by Claude Fable 5.1. The following is a synthesis of Marathon Health’s notification letter and state filings, and reporting from HIPAA Journal, BankInfoSecurity and other outlets.

Marathon Health, the Indianapolis company that runs on-site and near-site primary care clinics for employers, is notifying people about a breach that began with a conversation rather than an exploit. On August 24, someone posing as a Marathon IT worker obtained an employee’s credentials, signed into a cloud-hosted application and exported data, all “within a few hours,” according to the letter Marathon filed with the California attorney general. Filings on October 30 count 272,467 people in the three states that publish numbers, and a law firm investigating the case says the total reported to Texas is 5,684,735, many of whom never saw a Marathon clinician.

What Marathon Health told regulators

On August 24 the company “received an alert of suspicious activity related to one of our employee’s accounts,” disabled the account and brought in outside help. The investigation “determined that an unauthorized individual posing as a Marathon IT worker was able to obtain the employee’s credentials, used those credentials to access a cloud-hosted application, and exported information during that access.” On September 9 Marathon validated that personal information had been taken. Letters began October 20; the California filing is dated October 29 and the Texas, Massachusetts and Vermont filings October 30.

The letter describes the source as “one of our back-end health care operations databases” and lists names, dates of birth, contact information and Social Security numbers; the Texas filing adds medical and health insurance information. Marathon is offering 12 or 24 months of monitoring through Epiq and says it has no evidence of misuse. It does not name the application, say how the impersonator reached the employee, or mention whether multifactor authentication was in place. No group has claimed the theft; BankInfoSecurity checked ShinyHunters’ leak site on November 2 and found no listing.

How many people: 272,467 confirmed, 5.7 million reported

Texas lists 234,534 residents, Massachusetts 29,075 and Vermont 8,858, which Insurance Business totals at 272,467 across 14 state filings as of October 30. The larger figure comes from Emery Reddy, a law firm investigating a class action, which says Marathon reported 5,684,735 people to Texas regulators. Neither Marathon nor the Texas attorney general had confirmed that number by November 3. A search of the HHS Office for Civil Rights breach portal, where a breach of 500 or more people must be reported when individuals are notified, returned no record for Marathon on the evening of November 4; the portal’s newest posted submission was dated October 9, so the entry may simply be in the queue.

Marathon says it serves “over 3 million people across 41 states” through 720 health centers, and a breach total above that figure is possible only because the records cover people eligible for care, not just those who received it. If 5.68 million holds, HIPAA Journal ranks it the fourth-largest healthcare breach reported this year, behind DentaQuest’s 15 million and Lumexa Imaging’s 5.8 million, among others.

Why people who never set foot in a clinic got a letter

Indiana University explained the mechanism to its employees on October 15, five days before the letters started. Employees and family members on two of its Anthem plans are eligible for Marathon’s near-site centers, and “to administer this benefit, Marathon Health maintains information for all members enrolled in the eligible plans to communicate benefits, verify coverage and provide services such as scheduling appointments and billing insurance. As a result, individuals may be impacted even if they have never received care from Marathon Health.”

A clinic vendor needs the whole plan population to check eligibility, so it holds a copy of the roster, Social Security numbers included, for every member and dependent. One compromised account exposes the entire plan, and the letters arrive under the clinic’s name, so a human resources department can learn of the breach the same day its employees do.

The sector’s pattern, run in reverse

An April 2024 alert from HHS’s Health Sector Cybersecurity Coordination Center described callers posing as employees, claiming a broken phone, and persuading help desks to enroll a new device for multifactor authentication; its mitigations were callbacks to the number on record, in-person resets and supervisor confirmation.

Marathon’s case runs the other direction: the intruder was not an employee asking IT for help but someone pretending to be IT. That is the tactic Health-ISAC warned about in July, when it said health sector organizations were “facing an observed increase in successful attacks by the threat actor, ShinyHunters,” whose operators impersonate IT help desk staff, talk employees into revealing one-time codes or approving authentication prompts, and then pull data out of cloud applications using valid credentials. “More than a dozen member organizations have been hit by social-engineering attacks over the past couple of months,” Errol Weiss, Health-ISAC’s chief security officer, told Cybersecurity Dive. McKesson’s August breach followed the same identity-first playbook. Marathon names no group, and a pattern is not proof.

What an IT team can take from it

Verification has to run both ways. Help desks are trained to confirm callers; employees rarely get the mirror-image rule, that nobody from IT will ask for a password or a one-time code, and that any such request gets a callback to the published help desk number. Mike Hamilton, a former Seattle CISO, told BankInfoSecurity that a compromised account calls for terminating every active session, forcing credential resets and mapping what the account could reach.
Phishing-resistant MFA closes the gap a code can’t. Health-ISAC’s advice after the ShinyHunters campaigns was authentication that cannot be read aloud over a phone, with SMS and voice codes restricted.
Watch the exports, not just the logins. The alert fired the same day and was still too late: one account pulled a database of millions in hours. Bulk-export alerts and rate limits on cloud applications would have shortened that window.
Ask what the vendor holds. The roster is the exposure. Benefits teams can ask whether a clinic vendor needs Social Security numbers to verify eligibility at all, and how long it keeps people who leave the plan.

What to watch

The OCR portal entry will settle the count. At least two law firms are soliciting plaintiffs, and whether the 60-day notification clock started at the August 24 alert or the September 9 validation is likely to be argued in those cases rather than answered by Marathon.