Marathon Health confirmed in an October 2026 filing with the Vermont Attorney General that a data breach exposed patients’ Social Security numbers and health records. The number of people affected has not been publicly disclosed. Anyone who received care through Marathon Health should monitor credit reports and medical statements closely, and consider placing a credit freeze right away.
| Company | Marathon Health |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Social Security Numbers, Health Records |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unspecified/Unauthorized Access |
| Regulators Notified | Vermont Attorney General |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Marathon Health Data Breach?
Marathon Health has filed a formal data breach notification confirming that unauthorized access to its systems exposed sensitive personal information. The company disclosed the incident to the Vermont Attorney General’s office in October 2026. This filing is one of the clearest signs that a healthcare organization has confirmed a real compromise of patient data.
According to the notification, the breach involved Social Security numbers and health records. However, the exact date the intrusion was discovered has not been publicly disclosed. As a result, it remains unclear exactly how long unauthorized access may have continued before Marathon Health identified it.
Because this filing came through an official state regulator, it reflects the company’s own confirmed account of the incident rather than a third-party claim. In response, Marathon Health appears to have conducted an internal review before notifying regulators. Further details about the specific method of attack, such as whether it involved ransomware, phishing, or another form of unauthorized access, have not been made public at this time.
Who was affected?
Marathon Health provides workplace and community-based healthcare services, meaning the breach could affect patients who received care through its health centers. Because health records were involved, this likely includes individuals who shared personal and medical details as part of receiving treatment.
The exact number of affected individuals has not been publicly disclosed. In addition, the geographic scope of the breach beyond the Vermont filing is unclear. Still, because Marathon Health operates across multiple states, affected individuals could reside well outside Vermont.
It is also not clear whether employees, in addition to patients, had information involved in this breach. Therefore, anyone who has interacted with Marathon Health as a patient or healthcare consumer should consider themselves potentially affected until official notices clarify the scope further.
What Information Was Potentially Exposed?
The Vermont filing specifically identifies two categories of information involved in this breach. This means affected individuals should assume these particular data types were part of the exposure, rather than a broader or more generic set of personal details.
- Social Security Numbers
- Health Records
This combination of data is especially concerning because it merges financial identity markers with medical history. For example, a Social Security number alone can allow criminals to open new credit accounts or file fraudulent tax returns. When paired with health records, the risk expands further because criminals may use medical details to commit healthcare fraud or secure prescriptions and treatment under someone else’s identity.
Furthermore, this type of stolen data often appears on dark web marketplaces, where it can circulate for years after the original breach. Because Social Security numbers do not expire or change easily, individuals affected by this type of exposure face a long-term risk of identity theft. As a result, ongoing vigilance is necessary, not just a short-term response.
What is the company doing?
Marathon Health responded to the breach by filing an official notification with the Vermont Attorney General, confirming the exposure of Social Security numbers and health records. This step indicates the company has acknowledged the incident and is working through required legal disclosure processes.
In addition to the Vermont filing, Marathon Health has also filed formal notification with the Vermont Attorney General. Beyond this regulatory filing, specific details about remediation steps, such as whether credit monitoring or identity protection services are being offered, have not been publicly disclosed. Because notification requirements often lead to direct mailed letters, affected individuals should watch for official correspondence from Marathon Health describing any protective services available to them.
What Should Affected Individuals Do?
Monitor Your Credit Reports Closely
Affected individuals should begin checking their credit reports regularly for unfamiliar accounts or inquiries. This is one of the simplest ways to catch identity theft early, before significant financial damage occurs.
You can request free credit reports from each of the three major bureaus. Because fraudulent activity can appear months after a breach, it helps to space out these requests throughout the year so you have consistent coverage.
Consider a Credit Freeze or Fraud Alert
Since this breach involved Social Security numbers, placing a credit freeze is a strong protective step. A freeze restricts access to your credit file, which makes it much harder for criminals to open new accounts in your name.
Alternatively, a fraud alert requires lenders to take extra verification steps before approving new credit. Either option adds a meaningful layer of protection. Because both are free to set up, there is little downside to acting quickly.
Protect Against Healthcare and Medical Fraud
Because health records were exposed, affected individuals should also review their medical insurance statements closely. Look for unfamiliar claims, services you never received, or unrecognized providers listed on your records.
If you notice anything suspicious, contact your health insurer immediately. In addition, consider requesting a copy of your medical records to confirm their accuracy, since fraudulent entries could affect future diagnoses or treatment decisions.
Stay Alert for Phishing Attempts
After a breach involving health and identity data, scammers often follow up with targeted phishing emails or phone calls. These messages may reference the breach directly to appear legitimate.
Therefore, avoid clicking links or sharing information in response to unexpected messages. Instead, verify any communication by contacting Marathon Health directly through official channels before responding.
Consult a Data Breach Attorney
Given that Social Security numbers and health records were both involved, affected individuals may want to speak with a data breach attorney. An attorney can help evaluate whether you qualify for compensation through a potential class action.
Many attorneys offer free consultations for cases like this. As a result, there is minimal risk in exploring your legal options, especially if you experience financial or medical fraud linked to this incident.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
View the public data breach notification listing from Vermont Attorney General