Someone posing as a help desk staffer walked off with a cloud application’s contents in one afternoon. Marathon Health, which runs worksite primary care centers, is notifying about 5.69 million people.
The Indianapolis company runs more than 700 health centers across 41 states. It told Massachusetts regulators an August 24 alert flagged suspicious activity on an employee account, disabled within hours – but the caller had already used stolen credentials to open a cloud application and export records. Investigators confirmed September 9 that data left the system; letters began October 20.
People who never saw a clinician
Because the company holds eligibility files for everyone enrolled in a client’s medical plan, many recipients will open a letter from an organization they never heard of. Indiana University warned staff and dependents on October 15 that joining certain Anthem PPO plans was enough to be swept into the theft.
Texas regulators were told 234,534 residents were affected, Vermont listed 8,858 and Massachusetts 29,075. The full 5,684,735 total appeared in the Texas filing, first surfaced by law firm Emery Reddy. Names, birth dates, contact details, Social Security numbers and medical and health-plan data were involved. The incident is not yet posted on the HHS Office for Civil Rights portal.
The help desk is the new front door
Health-ISAC warned members in September about voice-phishing and domain-impersonation campaigns against healthcare organizations, counting more than a dozen recent incidents with ShinyHunters among the actors. No group has publicly claimed this intrusion.
The lesson is procedural. Help-desk staff need an out-of-band identity check before a password reset or multifactor re-enrollment, and a reported compromise should trigger session termination, forced resets and a sweep for mail-forwarding rules.
