Marathon Health, which runs on-site and virtual health centers for employers, is notifying people that an impostor posing as a Marathon IT worker obtained an employee’s login on August 24, 2026 and exported names, dates of birth, contact information and Social Security numbers. It is offering free Epiq monitoring; no lawsuit over the breach had been identified as of November 15, 2026, and there is nothing to claim.
Breach Notice · No Lawsuit Confirmed · Nothing to Claim
This page reports a data breach notice. Marathon Health has not been found liable for anything, OCA has not identified a lawsuit over the breach, no class has been certified, and there is nothing to claim. This page is informational and is not legal advice.
What Is This About?
Marathon Health provides on-site, near-site and virtual health care to the employees of various organizations and their family members. It is notifying people that information from one of its back-end health care operations databases was taken. Marathon filed a sample of its notice with the California Attorney General on October 29, 2026.According to the notice, Marathon received an alert of suspicious activity on an employee’s account on August 24, 2026, disabled the account and investigated with cybersecurity professionals. The investigation found that an unauthorized person posing as a Marathon IT worker obtained the employee’s credentials, used them to access a cloud-hosted application and exported information, all within a few hours that day. On September 9, 2026, Marathon confirmed that personal information had been obtained. It has not said how many people were notified.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Information Was Involved?
The notice says the information varied by individual and may have included name, date of birth, contact information and Social Security number. It does not list diagnoses, treatment or insurance information, although the data came from a health care operations database. Marathon says it has no evidence the information has been or will be misused.How the Impostor Got In
The notice describes a social engineering attack: someone impersonated Marathon’s own IT staff to get an employee to hand over login credentials, then used those credentials to reach a cloud application and export data. That technique, often carried out by phone or chat, has been behind a number of large breaches because it bypasses technical defenses by targeting the person who holds the password. Marathon says it has added safeguards to protect and monitor its systems.What Marathon Health Is Offering
Marathon is offering a free 12- or 24-month membership, depending on the letter, to identity monitoring through Epiq Monitoring Solutions, including credit monitoring, fraud consultation and identity theft restoration. Enrollment uses the activation code in the letter, and the enrollment deadline is printed in each letter.Federal law also gives anyone notified of a breach free fraud alerts and security freezes through the three national credit bureaus; the Federal Trade Commission’s IdentityTheft.gov site explains how they work.
Has a Lawsuit Been Filed?
As of November 15, 2026, OCA had not identified a class action over the Marathon Health breach. Breaches exposing Social Security numbers frequently lead to proposed class actions, and those claims would be allegations. OCA will update this page if a complaint is filed.Questions
What happened in the Marathon Health data breach?
According to Marathon’s notice, on August 24, 2026 an unauthorized person posing as a Marathon IT worker obtained an employee’s login credentials, used them to access a cloud-hosted application and exported information, all within a few hours. Marathon confirmed on September 9, 2026 that personal information was obtained.
What information was exposed in the Marathon Health breach?
The notice says the information varied by individual and may have included name, date of birth, contact information and Social Security number.
Who is Marathon Health?
Marathon Health provides on-site, near-site and virtual health care to employees of various organizations and their family members. People notified are generally connected to an employer that offers a Marathon health center, though the notice does not name employers.
How do I enroll in Marathon Health’s free monitoring?
The letter offers a 12- or 24-month Epiq Monitoring Solutions membership with an activation code and an enrollment deadline. The sample filed with the California Attorney General leaves both blank, so each letter states them.
Is there a Marathon Health data breach class action?
OCA had not identified a filed class action as of November 15, 2026. There is no settlement, fund or claim form.
Sources
• California Attorney General — Marathon Health breach report and sample notice• Federal Trade Commission — IdentityTheft.gov
