The 2026 Marathon Health data breach: Social Security numbers taken after a fake IT call

On 24 August 2026 someone contacted a Marathon Health employee, claimed to be from the company’s IT department, and got the employee to give up their login. With it, the intruder opened a cloud-hosted application and exported data from it over a few hours that same day. Marathon spotted the suspicious activity, shut the account and started an investigation. On 9 September it confirmed that personal information had been taken. Letters started on 20 October, filings in Texas, Massachusetts, Vermont and California followed, and law firms began advertising on 30 October.

Most people affected never chose Marathon Health. It runs on-site and near-site clinics that employers offer as a benefit, so the name you know may be your company’s health center rather than Marathon. To check coverage and bill insurers, Marathon also receives member lists from employer health plans. That is why letters are reaching employees, spouses and dependants who may never have booked an appointment. If you are not sure, your HR or benefits team can tell you whether your employer used Marathon.

Nobody broke Marathon’s software. One person trusted a convincing voice claiming to be from IT. The people who now hold names, birth dates and Social Security numbers can use the same trick on you: a call from “Marathon Health”, “your benefits team” or a “breach settlement office” that already knows your details and wants you to confirm the rest, or to pay to “file your claim”. Knowing your birthday proves nothing; that was in the stolen file. Hang up and call back on a number you looked up yourself. Our guide to telling a real breach letter from a fake covers the letters too.

A Social Security number and a date of birth are enough to open credit in your name. A freeze at Equifax, Experian and TransUnion is free, takes about ten minutes per bureau online, and blocks lenders from pulling your file, which stops most new accounts. It does not touch your score or your existing cards, and you can lift it for a day when you apply for credit yourself. Enroll in the free monitoring as well, but remember it only alerts you after someone has tried; the freeze stops them. Our guide on what to do after a data breach has links for each bureau.

The 2027 filing season opens in a couple of months, and a stolen Social Security number is exactly what someone needs to file a fake return and take your refund first. The IRS gives a six-digit Identity Protection PIN to anyone who verifies their identity on IRS.gov, and any return filed with your number but without the PIN is rejected. It is free, and a new PIN is issued every year. If you have children who were Marathon patients, you can get PINs for them too.

The Texas and Vermont filings list medical and health insurance information. That opens the door to medical identity theft: someone using your insurance to get treatment or prescriptions, which can leave false entries in your records. For the next year, read every Explanation of Benefits from your insurer and query any visit, provider or drug you do not recognize. Our guide to what to do after a medical data breach explains how to request your records and fix errors.

Since 30 October 2026 several firms have announced investigations, including Murphy Law Firm, Wolf Haldenstein and AWKO, and ClassAction.org and Claim Depot are gathering affected people. The questions they raise are the delay between the August intrusion and the October letters, and whether training should have stopped an impersonation call. Nothing is settled yet. Keep your letter: it is the easiest proof that you were in the class if a settlement comes. Our list of data breach settlements open for claims is where it will appear when there is something to file.