Episource data breach: Molina members' health data, and why some letters arrived in 2026

Why did I get an Episource letter in 2026?

Episource names Molina Healthcare and its affiliates, including Central Health Plan, among its customers. People Episource had no address for were first told through a substitute notice posted online. Molina later found their addresses, a process finished on February 3, 2026, and asked Episource to send individual letters. So the 2026 letters about a 2025 breach went to Molina members whose addresses had been missing. The guide to letters from companies you never dealt with explains how vendor breaches reach health plan members.

What happened at Episource?

Episource says it found unusual activity in its computer systems on February 6, 2025. It stopped the activity, began investigating with outside help, called law enforcement and turned off its computer systems. It began telling its customers what data was involved on April 23, 2025.

Date	What the letter and the regulators' records say
January 27, 2025	Access and copying begin
February 6, 2025	Episource finds the activity, stops it and shuts down its systems
April 23, 2025	Episource begins telling customers what data was involved
June 6, 2025	Report submitted to HHS: 6,725,572 people, as a business associate
October 15 and November 12, 2025	Notices recorded by California
February 3, 2026	Molina finishes finding addresses for members told only online
February 9, 2026	Supplemental letters; recorded by California
February 11, 2026	Posted on the Texas attorney general's list: 351,562 Texans
May 9, 2026	Extended deadline to sign up for the free service

What information was involved?

The data was not the same for everyone. It includes contact details (name, address, phone number and email) and one or more of:

Group	Examples in the letter
Health insurance data	Plans and policies, insurance companies, member and group ID numbers, Medicaid, Medicare and government payor ID numbers
Health data	Medical record numbers, doctors, diagnoses, medicines, test results, images, care and treatment
Other personal data	Date of birth

The Texas record also lists Social Security numbers, which the letter's list does not mention. Episource says it is not aware of any misuse of the data.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected (June 2025 report)	6,725,572
Texas attorney general	Texans (February 2026 posting)	351,562

The Texas figure ranks 12th on the Texas attorney general's 2026 list.

What is Episource offering?

Two years of free credit monitoring and identity theft protection, which the 2026 letters say can be signed up for until May 9, 2026.

Item	Detail from the letter
Length	Two years
Enrollment	app.idx.us/account-creation/protect, with the code on the letter
Deadline (2026 letters)	May 9, 2026
Phone	(877) 786-0549, Monday to Friday, 8 a.m. to 8 p.m. CT, except holidays

The letter's reference guide suggests checking statements from health care providers, insurers and banks for activity that is not yours.

What Washington's attorney general recorded

Washington's attorney general lists a report from Episource, LLC (Community Health Plan of Washington, Humana, Molina Healthcare, Regence), received on June 6, 2025, with 102,913 Washington residents affected and a breach date of January 27, 2025. For those residents the record lists names, dates of birth, health insurance policy or ID numbers and medical information as compromised.

What the documents leave open

• How the criminal got into Episource's systems.
• Which customers besides Molina had data involved.
• Why the Texas record lists Social Security numbers.

For more on how health vendors' breaches reach patients, see the HHS ranking of 2026 healthcare breaches and the HIPAA breach notification rule.