Breaches and incidentsBriefReported by a reputable outlet, citing the company
TriZetto Provider Solutions (Cognizant): web-portal breach exposes 3.4 million+ patients
TriZetto, a healthcare revenue-cycle business associate, identified suspicious activity on 2 Oct 2025 in a web portal its provider clients use.
- Disclosed
What happened
- TriZetto, a healthcare revenue-cycle business associate, identified suspicious activity on 2 Oct 2025 in a web portal its provider clients use; unauthorized access to historical eligibility transaction reports had begun in Nov 2024. On 26 Jan 2026 the count was revised up; the Oregon AG notice lists 3,433,965 and HIPAA Journal estimates over 3.6 million across states. Data: names, addresses, birth dates, SSNs, insurance member and Medicare beneficiary numbers. OCHIN said about 9% of its patients were affected through subcontracted billing.
- Root cause: compromise of a client-facing web portal; how the attacker got into the portal was not disclosed. Access went undetected for about 11 months.
- Attacker: not identified.
- Response: Mandiant engaged; TriZetto says the actor was eradicated; it is notifying on behalf of covered-entity clients and paying for monitoring.
Sources
- https://www.hipaajournal.com/trizetto-provider-solutions-data-breach/
- https://www.hipaajournal.com/h1-2026-healthcare-data-breach-report/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.