--- title: "Quantum Health vishing and network-data incident" description: "Quantum Health said a user responded to a vishing call—telephone phishing—on May 29, 2026, leading to unauthorized network access and acquisition of files through June 1." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-11-06" canonical_url: "https://www.ally.security/incidents/quantum-health-vishing-network-incident-2026" markdown_url: "https://www.ally.security/incidents/quantum-health-vishing-network-incident-2026.md" stix_url: "https://www.ally.security/incidents/quantum-health-vishing-network-incident-2026/stix.json" --- # Quantum Health vishing and network-data incident Quantum Health said a user responded to a vishing call—telephone phishing—on May 29, 2026, leading to unauthorized network access and acquisition of files through June 1. Last modified Nov 6, 2026 · 1 source ## Summary - **Environment:** Healthcare navigation and care-coordination systems - **Operational impact:** Network outage and acquisition of personal and health files - **Financial impact:** No incident cost publicly quantified ## What happened [Quantum Health](https://quantum-health.com/) said a user responded to a vishing call—telephone phishing—on May 29, 2026, leading to unauthorized network access and acquisition of files through June 1. [1](#source-1) ## Impact A June 1 outage affected internal and external systems. Potentially involved information included names, health-insurance and medical information, contact details, birth dates and demographics. The notice could not rule out Social Security number exposure. [1](#source-1) ## Timeline ### May 29, 2026 — Vishing call led to network access Vishing call led to network access, as described in the [incident notice](https://oag.ca.gov/system/files/Quantum%20Health%20-%20California%20Notification.pdf). [1](#source-1) ### June 1, 2026 — Outage detected and systems isolated Outage detected and systems isolated, as described in the [incident notice](https://oag.ca.gov/system/files/Quantum%20Health%20-%20California%20Notification.pdf). [1](#source-1) ### July 8, 2026 — Personal information identified in affected files Personal information identified in affected files, as described in the [incident notice](https://oag.ca.gov/system/files/Quantum%20Health%20-%20California%20Notification.pdf). [1](#source-1) ### July 27, 2026 — Health-plan notifications began Health-plan notifications began, as described in the [incident notice](https://oag.ca.gov/system/files/Quantum%20Health%20-%20California%20Notification.pdf). [1](#source-1) ### November 6, 2026 — Briefing updated This briefing was last reviewed and updated on November 6, 2026. ## Threat Group & Attack Vector Quantum Health attributed the network access to a user responding to a telephone phishing call. The notice does not describe the caller’s pretext or the specific account controls involved. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - T1566.004 — [Spearphishing Voice](https://attack.mitre.org/techniques/T1566/004/). [1](#source-1) ## Response Quantum Health isolated systems, engaged forensic specialists and reported the incident to federal law enforcement. It identified personal information in the affected files July 8 and began notifying affected health plans July 27. [1](#source-1) The company added security measures and offered identity monitoring. The public California template does not establish a monitoring duration or total affected-person count. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Quantum Health — Notice of Data Security Incident official · Quantum Health
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Quantum Health vishing and network-data incident: Vishing call led to network access 2. **Resulted In · 100% confidence · current** Quantum Health vishing and network-data incident: Health-plan notifications began 3. **Resulted In · 100% confidence · current** Quantum Health vishing and network-data incident: Outage detected and systems isolated 4. **Resulted In · 100% confidence · current** Quantum Health vishing and network-data incident: A June 1 outage affected internal and external systems. Potentially involved information included names, health-insurance and medical information, contact details, birth dates and demographics. The notice could not rule out Social Security number exposure. 5. **Occurred At · 100% confidence · current** Personal information identified in affected files: 2026-07-08 6. **Resulted In · 100% confidence · current** Quantum Health vishing and network-data incident: Quantum Health isolated systems, engaged forensic specialists and reported the incident to federal law enforcement. It identified personal information in the affected files July 8 and began notifying affected health plans July 27. 7. **Occurred At · 100% confidence · current** Health-plan notifications began: 2026-07-27 8. **Occurred At · 100% confidence · current** Outage detected and systems isolated: 2026-06-01 9. **Occurred At · 100% confidence · current** Vishing call led to network access: 2026-05-29 10. **Resulted In · 100% confidence · current** Quantum Health vishing and network-data incident: The company added security measures and offered identity monitoring. The public California template does not establish a monitoring duration or total affected-person count. 11. **Affected Organization · 100% confidence · current** Quantum Health vishing and network-data incident: Quantum Health 12. **Used Attack Technique · 100% confidence · current** Quantum Health vishing and network-data incident: https://attack.mitre.org/techniques/T1566/004/ 13. **Discovered At · 100% confidence · current** Quantum Health vishing and network-data incident: 2026-06-01 14. **Resulted In · 100% confidence · current** Quantum Health vishing and network-data incident: Quantum Health said a user responded to a vishing call—telephone phishing—on May 29, 2026, leading to unauthorized network access and acquisition of files through June 1. 15. **Resulted In · 100% confidence · current** Quantum Health vishing and network-data incident: Personal information identified in affected files