2025 Unauthorized system access — 6.6M patients
Data compromised
Names, addresses, phone numbers, email, SSNs, health insurance info, Medicaid-Medicare IDs, medical records, diagnoses, test results, medications, treatment details
Technical writeup
Unauthorized cybercriminal accessed Episource systems between January 27 and February 6, 2025. Healthcare services company providing risk adjustment and medical coding; owned by Optum (UnitedHealth). Exposed data included Medicaid-Medicare IDs, medical records, diagnoses, test results, medications, and treatment details. Second-largest breach reported to HHS in 2025.
Root cause
Unauthorized access to internal systems.