YorozuyaIT
Cyber News Explained

Marathon Health Breach: How a Fake IT Worker Led to Data Exposure for Nearly 5.7 Million People

Written by the Yorozuya IT editorial team, based in Japan. Menus, apps, and rules change, so check the date.

Short answer

Not every large breach starts with a clever exploit. In this one, according to a notice filed with Massachusetts regulators and reported by ISMG, an unauthorized person posed as a Marathon Health IT worker, obtained an employee's credentials, used them to get into a cloud-hosted application, and exported information. Marathon Health, which provides workplace health care for employers and public-sector organizations, discovered the activity on August 24, 2026. This week it was reported to affect nearly 5.7 million people.

The chain, step by step

Four-step attack chain: impersonation, credentials handed over, cloud login, data export, with four defensive controls

  1. Impersonation. The attacker claims to be from internal IT.
  2. Credentials handed over. An employee provides login details.
  3. Cloud login. Valid credentials open the application. No malware is needed, and there is no "hack" in the traditional sense.
  4. Data export. Information is exported, in this case over a few hours.

The notice does not describe the channel used for the impersonation, so we will not guess. The pattern, though, is familiar: attackers contact staff or help desks, pretend to be colleagues, and ask for access.

Why healthcare and cloud apps are attractive

Healthcare organizations hold names, Social Security numbers, insurance data, and medical details in one place. That combination is valuable for identity theft and fraud, and it cannot be changed like a password. Cloud applications make access easy for staff, and just as easy for anyone holding valid credentials.

Four controls that cut the chain

  1. Verify the caller. Staff should end the conversation and call back on a known internal number before sharing anything. IT should never ask for a password.
  2. Use phishing-resistant MFA. Passkeys and hardware security keys are tied to the real website, so a stolen or spoken code is not enough.
  3. Apply least privilege. Few people should be able to reach, and bulk-export, sensitive records.
  4. Alert on exports. A large download from a new location should raise an alarm in minutes, not months.

If you received a notice

If you run IT

Write the call-back rule into policy, test it with a drill, and make sure staff know who to report suspicious calls to without fear of blame. Then check which accounts can export data in bulk.

Sources

Reported as of November 5, 2026. Figures may change as notifications are filed.

FAQ

What information may have been exposed?

Notices say it may include names, dates of birth, contact details, addresses, Social Security numbers, health records, medical information, and health insurance information. What applies varies by person.

I got a notice. What should I do?

Read it carefully, use only the contact details in the official letter or on the company's own website, consider a credit freeze or fraud alert, and watch insurance statements for services you did not receive.

Would multi-factor authentication have stopped this?

It depends on the type. Codes sent by text or an app can sometimes be talked out of an employee by a convincing caller. Phishing-resistant methods, such as passkeys or security keys, are much harder to hand over.

Keep reading

Cyber News Explained2 min read

Windows 10 Security Updates Now Run to October 2027: How to Enrol, and What to Do Before They End

Microsoft quietly extended consumer Extended Security Updates for Windows 10 by a year, to 12 October 2027. Who qualifies, the three ways to enrol, what ESU does not cover, and a simple decision path for PCs that cannot run Windows 11.

Cyber News Explained3 min read

cPGuard Update Hijack: When a Security Tool's Own Update Delivers the Backdoor

On November 2, attackers used compromised credentials to push fake updates of the cPGuard server security suite to thousands of Linux servers. A diagram of the supply-chain attack, what the script collected, and exactly what to rotate.

Cyber News Explained3 min read

The Freezer Hacks: How a Cyberattack on a Refrigeration Supplier Reached French Supermarkets and Blood Banks

In early November, attackers changed temperature and defrost settings on refrigeration controllers in Europe, including at three French blood-bank sites. A diagram of how a supplier compromise turns into a warm freezer, and what saved the plasma.