---
title: "MPOWERHealth network intrusion"
description: "MPOWERHealth detected unauthorized access to part of its internal network on or about June 26, 2025. It secured the network, notified law enforcement and engaged external cybersecurity specialists."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-14"
canonical_url: "https://www.ally.security/incidents/mpowerhealth-network-intrusion-2025"
markdown_url: "https://www.ally.security/incidents/mpowerhealth-network-intrusion-2025.md"
stix_url: "https://www.ally.security/incidents/mpowerhealth-network-intrusion-2025/stix.json"
---

# MPOWERHealth network intrusion

MPOWERHealth detected unauthorized access to part of its internal network on or about June 26, 2025. It secured the network, notified law enforcement and engaged external cybersecurity specialists.

Last modified Nov 14, 2026 · 2 sources

## Summary

- **Environment:** Internal healthcare network
- **Operational impact:** Personal-information access or exposure reported; disruption not quantified
- **Financial impact:** No confirmed incident cost quantified

## What happened

[MPOWERHealth](https://mpowerhealth.com/) detected unauthorized access to part of its internal network on or about June 26, 2025. It secured the network, notified law enforcement and engaged external cybersecurity specialists. [2](#source-2)

## Impact

On October 20, 2026, its review determined impacted files may have contained personal information. Fields varied by person and included names, birth dates, Social Security and government ID numbers, financial-account details, medical information and health-insurance information. [2](#source-2) The [individual letter](https://oag.ca.gov/system/files/MPOWER_-_Redacted_Letter_40479284v1.pdf) places possible file access or acquisition during June 23–26, 2025. [1](#source-1)

## Timeline

### October 20, 2026 — Personal-information impact identified

Personal-information impact identified. [2](#source-2)

### November 13, 2026 — Individual notifications begin

Individual notifications begin. [2](#source-2)

### November 14, 2026 — Briefing updated

This briefing was last reviewed and updated on November 14, 2026.

## Threat Group & Attack Vector

The notice does not establish the initial access method.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific ATT\&CK technique is mapped from the available evidence.

## Response

MPOWERHealth began notifying affected individuals November 13, 2026 and continued reviewing security controls. It reported no evidence of unintended use of the medical information. [2](#source-2) See the [notification](https://mpowerhealth.com/notice-of-data-security-incident/).

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/mpowerhealth-network-intrusion-2025/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### MPOWERHealth individual notification letter

official · MPOWERHealth Holdings LLC

<https://oag.ca.gov/system/files/MPOWER_-_Redacted_Letter_40479284v1.pdf>

<a id="source-2"></a>

### MPOWERHealth Holdings LLC security incident notice

official · MPOWERHealth Holdings LLC · Nov 13, 2026

<https://mpowerhealth.com/notice-of-data-security-incident/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   MPOWERHealth network intrusion: Individual notifications begin
2. **Resulted In · 100% confidence · current**  
   MPOWERHealth network intrusion: MPOWERHealth began notifying affected individuals November 13, 2026 and continued reviewing security controls. It reported no evidence of unintended use of the medical information.
3. **Affected Organization · 100% confidence · current**  
   MPOWERHealth network intrusion: MPOWERHealth Holdings LLC
4. **Ended At · 100% confidence · current**  
   MPOWERHealth network intrusion: 2025-06-26
5. **Resulted In · 100% confidence · current**  
   MPOWERHealth network intrusion: MPOWERHealth detected unauthorized access to part of its internal network on or about June 26, 2025. It secured the network, notified law enforcement and engaged external cybersecurity specialists.
6. **Began At · 100% confidence · current**  
   MPOWERHealth network intrusion: 2025-06-23
7. **Resulted In · 100% confidence · current**  
   MPOWERHealth network intrusion: Personal-information impact identified
8. **Occurred At · 100% confidence · current**  
   Individual notifications begin: 2026-11-13
9. **Resulted In · 100% confidence · current**  
   MPOWERHealth network intrusion: On October 20, 2026, its review determined impacted files may have contained personal information. Fields varied by person and included names, birth dates, Social Security and government ID numbers, financial-account details, medical information and health-insurance information.
10. **Occurred At · 100% confidence · current**  
   Personal-information impact identified: 2026-10-20
11. **Resulted In · 100% confidence · current**  
   MPOWERHealth network intrusion: The individual notice places potential access or acquisition of files during June 23–26, 2025.

</details>