Episource, a major US healthcare data provider, confirmed a cyberattack in late January 2025, affecting over 5 million patients, including policy and MedicAid information.
The intrusion was discovered on February 6, 2025, and data copies were taken between January 27 and February 6, 2025.
Data stolen includes health plans, insurance companies, member/group ID numbers, Medicaid-Medicare ID numbers, medical records, diagnoses, medications, test results, and personal data like dates of birth and Social Security numbers.
Cybercriminals often target healthcare organizations for sensitive data that can be used in phishing and identity theft scams.
Episource reported to have notified 5,418,866 affected individuals on April 23, 2025.
The company advises impacted individuals to stay vigilant against potential impersonation and scam attempts.