Summary
- Environment: Marathon Health database supporting employer-sponsored health benefits
- Operational impact: Individual notification announced; no clinical-service outage established in the reviewed notices
- Financial impact: No incident cost quantified in the reviewed notices
- Record status: Developing record. Reviewed November 1, 2026; updated as evidence emerges.
What happened
Marathon Health notified Indiana University of a security incident involving information in one of its databases. The university’s October 15 notice warned that eligible medical-plan members could be affected even if they had never received care from Marathon Health. [3]
SMART Local 265 also informed members about the incident at Marathon Health, which provides Union Wellness Center benefits related to its Welfare Fund. These notices concern the vendor’s incident; they do not establish separate intrusions at the university or union. [1][3]
Impact
- Vermont’s Attorney General table records 8,858 affected Vermont residents in Marathon Health’s October 30 report. This is a state-specific count, not a nationwide total. The filed categories are Social Security numbers and health records. [2]
- SMART Local 265 said, according to Marathon Health, that members’ names and Social Security numbers may have been involved. Details vary by person and are provided in individual letters. [1][3]
- Indiana University explained that Marathon Health holds information for all members of eligible Anthem PPO plans to administer benefits, verify coverage and provide services. Prior use of a health center is therefore not a condition for possible exposure. [3]
Timeline
Vermont records Marathon Health’s report
The state table lists the affected Vermont residents and reported information categories.
[2]Briefing updated
This briefing was last reviewed and updated on November 1, 2026.
Threat Group & Attack Vector
The reviewed university, union and Vermont notices establish a database incident but do not specify the initial access method, attacker or precise intrusion dates. The Vermont table records submitted reports rather than an independent forensic finding. [1][2][3]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Indiana University said individual letters would describe the affected information and complimentary identity monitoring. SMART Local 265 said people whose Social Security numbers were impacted would receive credit monitoring and identity-theft protection, with separate letters for eligible dependents where applicable. [1][3]