2026 MedImpact PBM — Oct 2025 unauthorized activity; ~327,082 members (OR AG)
Data compromised
Per MedImpact notice: may include name plus address, DOB, subscriber number; limited health/prescription/treatment info; insurance IDs; in limited instances SSNs. Oregon AG / state reporting aggregation cites ~327,082 impacted.
Technical writeup
Verified company disclosure — MedImpact substitute notice: unauthorized activity Oct 18, 2025; investigation finalized Jul 17, 2026; clients notified Aug 13; individual mailings began ~Sep 23–25, 2026 on behalf of clients. Data may include names + address/DOB/subscriber #, prescription/treatment details, insurance IDs, limited SSNs. Census unpublished — recordsAffected 0. companyConfirmed true. Actor attribution (Qilin) remains unverified secondary reporting. Updated Oct 1, 2026: recordsAffected set to 327082 per Oregon Department of Justice data-breach listing / Claim Depot aggregation of state notices; class-action investigators soliciting affected members.
Root cause
Unauthorized activity in MedImpact systems identified Oct 18, 2025 (company substitute notice; investigation finalized Jul 17, 2026)
References
- https://assets.medimpact.com/asset/f995c600-2fce-4d18-ab98-384de1c85b37/MedImpact-Substitute-Notice.pdf
- https://www.insurancebusinessmag.com/us/news/benefits/medimpact-pbm-breach-leaves-employer-plan-members-health-data-exposed-591424.aspx
- https://www.classaction.org/media/medimpact-data-breach-web-notice-2026.pdf
- https://justice.oregon.gov/consumer/DataBreach
- https://www.claimdepot.com/data-breach/medimpact-2026
- https://www.classaction.org/data-breach-lawsuits/medimpact-healthcare-systems-september-2026