2026 MedImpact PBM — Oct 2025 unauthorized activity; member PHI notices Sep 2026
Data compromised
Per MedImpact notice: may include name plus address, DOB, subscriber number; limited health/prescription/treatment info; insurance IDs; in limited instances SSNs. Affects members of pharmacy benefit plans administered by MedImpact and/or Elixir Solutions. Nationwide census unpublished (client-by-client notices, e.g. Leggett & Platt CA AG filings). Qilin leak-site claim reported in secondary coverage — not confirmed by MedImpact.
Technical writeup
Verified company disclosure — MedImpact substitute notice: unauthorized activity Oct 18, 2025; investigation finalized Jul 17, 2026; clients notified Aug 13; individual mailings began ~Sep 23–25, 2026 on behalf of clients. Data may include names + address/DOB/subscriber #, prescription/treatment details, insurance IDs, limited SSNs. Census unpublished — recordsAffected 0. companyConfirmed true. Actor attribution (Qilin) remains unverified secondary reporting.
Root cause
Unauthorized activity in MedImpact systems identified Oct 18, 2025 (company substitute notice; investigation finalized Jul 17, 2026)
References
- https://assets.medimpact.com/asset/f995c600-2fce-4d18-ab98-384de1c85b37/MedImpact-Substitute-Notice.pdf
- https://www.insurancebusinessmag.com/us/news/benefits/medimpact-pbm-breach-leaves-employer-plan-members-health-data-exposed-591424.aspx
- https://www.classaction.org/media/medimpact-data-breach-web-notice-2026.pdf