2026 TriWest Healthcare Alliance — TRICARE West breach; 11,844 beneficiaries (Apr)
Data compromised
Per TriWest notification letters and Military Times: names, Department of Defense Benefits Numbers, and ZIP codes for most affected beneficiaries; in fewer than five instances also Social Security numbers, addresses, and dates of birth
Technical writeup
Verified healthcare data breach — disclosed July 2026. TriWest Healthcare Alliance, the managed care contractor for TRICARE West Region covering roughly four million military beneficiaries, discovered a security incident on April 16, 2026 in which an unauthorized person gained limited access to TriWest information and downloaded it. TriWest stated it was unaware of misuse and is offering 24 months of Experian credit monitoring. Notification letters dated around July 2, 2026 describe health-related and personal information including names, DoD Benefits Numbers, and ZIP codes; SSNs, addresses, and birthdates applied in fewer than five cases. The U.S. HHS Office for Civil Rights breach portal lists Defense Health Agency (TriWest) with 11,848 individuals affected, submitted May 21, 2026, classified as hacking/IT incident on a network server with a business associate present. TriWest reported strengthened password-reset controls, access monitoring, and employee security training after the event.
Root cause
Unauthorized person gained limited access to TriWest systems April 16, 2026 and downloaded information; Defense Health Agency/TRICARE West contractor notification