Summary
- Environment: Healthcare navigation and care-coordination systems
- Operational impact: Network outage and acquisition of personal and health files
- Financial impact: No incident cost publicly quantified
- Record status: Developing record. Reviewed November 6, 2026; updated as evidence emerges.
What happened
Quantum Health said a user responded to a vishing call—telephone phishing—on May 29, 2026, leading to unauthorized network access and acquisition of files through June 1. [1]
Impact
A June 1 outage affected internal and external systems. Potentially involved information included names, health-insurance and medical information, contact details, birth dates and demographics. The notice could not rule out Social Security number exposure. [1]
Timeline
Vishing call led to network access
Vishing call led to network access, as described in the incident notice.
[1]Outage detected and systems isolated
Outage detected and systems isolated, as described in the incident notice.
[1]Personal information identified in affected files
Personal information identified in affected files, as described in the incident notice.
[1]Health-plan notifications began
Health-plan notifications began, as described in the incident notice.
[1]Briefing updated
This briefing was last reviewed and updated on November 6, 2026.
Threat Group & Attack Vector
Quantum Health attributed the network access to a user responding to a telephone phishing call. The notice does not describe the caller’s pretext or the specific account controls involved. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1566.004 — Spearphishing Voice. [1]
Response
Quantum Health isolated systems, engaged forensic specialists and reported the incident to federal law enforcement. It identified personal information in the affected files July 8 and began notifying affected health plans July 27. [1]
The company added security measures and offered identity monitoring. The public California template does not establish a monitoring duration or total affected-person count. [1]