--- title: "Marathon Health database security incident" description: "Marathon Health notified benefit providers of a database incident; Vermont recorded 8,858 affected residents." incident_type: "Data incident" status: "active" last_modified: "2026-11-01" canonical_url: "https://www.ally.security/incidents/marathon-health-database-security-incident-2026" markdown_url: "https://www.ally.security/incidents/marathon-health-database-security-incident-2026.md" stix_url: "https://www.ally.security/incidents/marathon-health-database-security-incident-2026/stix.json" --- # Marathon Health database security incident Official notices describe a vendor database incident that may affect eligible members even if they never used its health centers. Last modified Nov 1, 2026 · 3 sources ## Summary - **Environment:** Marathon Health database supporting employer-sponsored health benefits - **Operational impact:** Individual notification announced; no clinical-service outage established in the reviewed notices - **Financial impact:** No incident cost quantified in the reviewed notices ## What happened [Marathon Health](https://marathon.health/) notified [Indiana University](https://www.iu.edu/) of a security incident involving information in one of its databases. The university’s [October 15 notice](https://today.iu.edu/live/news/53973-marathon-health-data-incident-impacts-some-iu-medical-) warned that eligible medical-plan members could be affected even if they had never received care from Marathon Health. [3](#source-3) [SMART Local 265](https://www.smart265.org/) also [informed members](https://www.smart265.org/news/article?p=465) about the incident at Marathon Health, which provides Union Wellness Center benefits related to its Welfare Fund. These notices concern the vendor’s incident; they do not establish separate intrusions at the university or union. [1](#source-1) [3](#source-3) ## Impact - Vermont’s [Attorney General table](https://ago.vermont.gov/categories/security-breach-notices) records 8,858 affected Vermont residents in Marathon Health’s October 30 report. This is a state-specific count, not a nationwide total. The filed categories are Social Security numbers and health records. [2](#source-2) - SMART Local 265 said, according to Marathon Health, that members’ names and Social Security numbers may have been involved. Details vary by person and are provided in individual letters. [1](#source-1) [3](#source-3) - Indiana University explained that Marathon Health holds information for all members of eligible Anthem PPO plans to administer benefits, verify coverage and provide services. Prior use of a health center is therefore not a condition for possible exposure. [3](#source-3) ## Timeline ### October 15, 2026 — Indiana University informs plan members The university’s [notice](https://today.iu.edu/live/news/53973-marathon-health-data-incident-impacts-some-iu-medical-) said Marathon Health planned to begin direct notification on October 20. This was an announced start date, not confirmation that every letter had been sent. [3](#source-3) ### October 30, 2026 — Vermont records Marathon Health’s report The [state table](https://ago.vermont.gov/categories/security-breach-notices) lists the affected Vermont residents and reported information categories. [2](#source-2) ### November 1, 2026 — Briefing updated This briefing was last reviewed and updated on November 1, 2026. ## Threat Group & Attack Vector The reviewed university, union and Vermont notices establish a database incident but do not specify the initial access method, attacker or precise intrusion dates. The Vermont table records submitted reports rather than an independent forensic finding. [1](#source-1) [2](#source-2) [3](#source-3) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response Indiana University said individual letters would describe the affected information and complimentary identity monitoring. SMART Local 265 said people whose Social Security numbers were impacted would receive credit monitoring and identity-theft protection, with separate letters for eligible dependents where applicable. [1](#source-1) [3](#source-3) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Marathon Health/UWC Data Breach official · SMART Local 265 ### Security Breach Notices regulatory · Vermont Office of the Attorney General ### Marathon Health data incident impacts some IU medical plan members official · Indiana University · Oct 15, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Marathon Health database security incident: The Vermont Attorney General’s table records an October 30, 2026 report from Marathon Health, with Social Security numbers and health records listed as the categories breached. The table reflects submitted reports, not an independent forensic finding. 2. **Resulted In · 100% confidence · current** Marathon Health database security incident: Indiana University said the information involved varies by person and Marathon Health would begin direct notification on October 20, 2026, with details in individual letters and complimentary identity-monitoring services. 3. **Resulted In · 100% confidence · current** Marathon Health database security incident: Marathon Health report recorded in Vermont 4. **Resulted In · 100% confidence · current** Marathon Health database security incident: Indiana University said on October 15, 2026 that Marathon Health had notified it of a security incident involving information in one of Marathon Health’s databases. 5. **Occurred At · 100% confidence · current** Indiana University informs medical-plan members: 2026-10-15 6. **Affected Individual Count · 100% confidence · current** Marathon Health database security incident: 8,858 individual 7. **Resulted In · 100% confidence · current** Marathon Health database security incident: Indiana University informs medical-plan members 8. **Vendor Of · 100% confidence · current** Marathon Health: Indiana University 9. **Resulted In · 100% confidence · current** Marathon Health database security incident: Indiana University said Marathon Health maintains information for all members of its eligible Anthem PPO plans to communicate benefits, verify coverage and provide services, so members may be affected even if they never received care from Marathon Health. 10. **Resulted In · 100% confidence · current** Marathon Health database security incident: SMART Local 265 said Marathon Health provides Union Wellness Center benefits related to its Welfare Fund and reported, according to Marathon Health, that the incident may have involved members’ names and Social Security numbers. 11. **Disclosed At · 100% confidence · current** Marathon Health database security incident: 2026-10-15 12. **Resulted In · 100% confidence · current** Marathon Health database security incident: SMART Local 265 said people whose Social Security numbers were impacted would receive credit monitoring and identity-theft protection, and eligible dependents would receive separate letters where applicable. 13. **Affected Organization · 100% confidence · current** Marathon Health database security incident: Marathon Health 14. **Occurred At · 100% confidence · current** Marathon Health report recorded in Vermont: 2026-10-30