Marathon Health Data Breach Notice (Indiana Attorney General)

The personal information of 2,811 people was exposed in a data breach at Marathon Health. The incident occurred on August 24, 2026, and the organisation filed its notification with the Indiana Attorney General on October 29, 2026 — an interval of 66 days.

Personal information carries lifelong risk

The filing lists personal information as exposed in the incident. No passwords, no financial account numbers, and no government identifiers such as Social Security numbers appear in the disclosed categories. This is genuinely good news: nothing on the exposed list can be reissued or cancelled like a credit card.

Health-related data, when included, retains value to identity thieves and fraudsters for decades because it cannot be changed. Even without permanent identifiers on the list, the combination of personal details tied to a healthcare provider can still support targeted fraud, medical identity theft, or social engineering.

What the 66-day gap means

The record shows the breach happened on August 24 and the notification was filed on October 29. That two-month-plus interval is the most concrete fact this filing provides. Notification timelines vary by state and by when an investigation concludes; the filing itself does not characterise the gap.

How to know if this involves you

Marathon Health is required to notify affected individuals directly, usually by mail. If you have not received a letter, your information was likely not included. However, if you have moved since August 24, 2026, contact the organisation directly to confirm whether you were affected.

Protecting yourself after this exposure

• Monitor your Explanation of Benefits statements. Review every EOB from Marathon Health and your insurance carriers for services you did not receive. Medical identity theft often appears here first.
• Place a fraud alert with the three major credit bureaus. A fraud alert requires lenders to verify your identity before opening new accounts and lasts for one year.
• Review your credit reports annually for free. Check for accounts or inquiries you do not recognise. The exposure of personal information makes synthetic identity attempts more plausible even without a Social Security number on the list.
• Be wary of unsolicited contact claiming to be from Marathon Health or your insurer. Use known contact numbers rather than those provided in unexpected calls or emails.

The filing establishes that 2,811 Indiana residents were affected and that personal information was exposed. No further technical details about the cause or method are disclosed.