Yes. A class action could follow the Marathon Health data breach, but no filed complaint is documented yet.
A class action is a lawsuit where a few affected people sue on behalf of a larger group. Marathon Health runs work-based clinics for employers, unions and public agencies. Emery Reddy puts the national total at 5,684,735 people in the Emery Reddy breach analysis, including 234,534 Texas residents.
Official resources:
- Register through Insurancebusinessmag’s official page — Use this page to review requirements and register directly.
- Explore the official data from Ahdootwolfson — Use this primary source to review the underlying data.
Table of Contents
- How did the breach happen?
- Who is included in the affected group?
- What information was exposed?
- What should you do now?
How did the breach happen?
HIPAA Journal reports in the HIPAA Journal breach report that Marathon Health found suspicious activity in an employee account on August 24, 2026. The company disabled the account quickly. An unauthorized person posing as Marathon IT staff had stolen credentials to reach a cloud application and export data.
HIPAA Journal also reports that Marathon Health finished its review on September 9, 2026. The review confirmed that personal information was involved. Mailed notice letters started going out on October 20, 2026.
Who is included in the affected group?
Insurance Business Magazine reports that the affected people are patients of Marathon Health worksite clinics. That includes on-site, near-site and virtual clinics. It includes employees and family members enrolled through work-based health programs.
State filings listed at least 272,467 people across 14 states as of October 30, 2026. Texas had the largest listed group at 234,534 residents. The national total reported later is far larger than those early state tallies.
What information was exposed?
HIPAA Journal reports that exposed data includes names, contact information, dates of birth and Social Security numbers. Texas and Massachusetts filings also list medical information and health-insurance information. The exact mix varies by person.
Insurance Business Magazine reports that Vermont and Massachusetts filings list Social Security numbers and health records for thousands of residents. Social Security numbers raise the risk of identity theft. Medical and insurance details raise the risk of fraud involving care or benefits.
What should you do now?
Save the mailed notice and do not throw it away. It may prove you received notice and show which data was listed for you. Ahdoot and Wolfson states on the Ahdoot and Wolfson investigation page that Marathon Health is offering 12 to 24 months of free identity monitoring through Epiq Monitoring Solutions.
Law firms including Ahdoot and Wolfson say they are investigating a possible class action. No case filing has been documented, so there is no claim form or payout yet. Use the offered monitoring now and watch for new filings that name who may qualify.
- Open the notice and find the enrollment code and deadline
- Enroll in the free credit monitoring and restoration help
- Watch bank, insurance and medical statements for unknown activity
- Keep copies of the notice, enrollment proof and any fraud alerts