Threat watch / Breach
Marathon Health: a fake IT worker got an employee's credentials
Marathon Health, a US provider of employer-sponsored health centres, says an attacker posing as a Marathon IT worker tricked an employee into giving up their credentials on August 24, then exported data from a cloud-hosted application within a few hours. Names, dates of birth and Social Security numbers were taken. Marathon has not published a total; reported counts range from about 272,000 in state filings to nearly 5.7 million.
- Sector
- Health
- Way in
- Phishing, social engineering
- Product or vendor
- None named
- How it happened
- Social engineering: "an unauthorized individual posed as a Marathon IT worker and tricked the employee into disclosing their credentials", which gave access to a cloud-hosted application. The data was exported within a few hours on August 24.[1][2] Checked 9 Nov 2026
- What was stolen
- Names, contact information, dates of birth and Social Security numbers, according to the California notice; the Texas and Vermont filings also list medical and health insurance information.[1][4] Checked 9 Nov 2026
- Who was impacted
- Not settled. State attorney general filings counted at least 272,467 people as of October 30 (Insurance Business). HIPAA Journal, citing a law firm, reports 5,684,735 people in the Texas filing, and BankInfoSecurity reports nearly 5.7 million. Paubox notes the total is not yet confirmed by Marathon or reported to the US health department (HHS).[1][2][3][4] Checked 9 Nov 2026
- Threat actor
- Not attributed. No group has claimed the attack, according to HIPAA Journal, which notes that ShinyHunters and Scattered Spider use this tactic. No attribution.
Timeline
- Suspicious activity is flagged on an employee account. The attacker, posing as IT, had obtained the employee's credentials and exports data from a cloud-hosted application within a few hours. [1][2]
- Marathon's review confirms that personal information was obtained. [1][3]
- A breach notice is filed in California; letters to affected people go out in late October, with 12 or 24 months of credit monitoring. [1][3][4]
- Insurance Business counts at least 272,467 people across state filings as of October 30, while BankInfoSecurity reports that nearly 5.7 million people could be affected. Marathon has not published a total. [2][3]