Insightin Health breach: health plan members' data reached through an unknown flaw in vendor software

What happened in the Insightin Health breach?

Insightin says it found unusual activity in its computer system in September 2025 and began an investigation with outside experts. It says files may have been looked at or copied between September 17 and 23, 2025, and that it gave its clients, the recipients' health plans, information about the incident between December 4 and December 18, 2025.

Date	What the letter and the regulators' records say
September 2025	Insightin finds unusual activity
September 17 to 23, 2025	Files may have been viewed or copied; September 17 is the breach date on Washington's list and California's record
December 4 to 18, 2025	Insightin informs its health plan clients
January 16, 2026	Report submitted to HHS
February 20, 2026	Washington records notices for Wellcare of Washington, Coordinated Care of Washington and Wellcare Health Insurance Company of Washington
March 5, 2026	Washington records a notice naming Centene Corporation; first notice recorded by California
March 10, 2026	Posted on the Texas attorney general's list
April 1, 2026	Supplemental notice recorded by California

What information was involved?

The letter says the files held each person's name, date of birth, gender and health plan information, and that no Social Security numbers or financial information were in them. The state lists agree on the absence of Social Security numbers: Washington and Texas record names, dates of birth or addresses, health insurance and medical information, and none lists Social Security numbers. Three of Washington's notices also list email addresses with passwords or security question answers, which the letter does not mention.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	1,949,534
Texas attorney general	Texans	143,346
Washington attorney general	Washingtonians, Centene Corporation notice	11,740
Washington attorney general	Washingtonians, three Wellcare and Coordinated Care notices	3,357

It is the sixth largest 2026 business associate report among the federal list's open cases.

What is Insightin offering people who got a letter?

Twelve months of free credit monitoring through Cyberscout, a TransUnion company; Insightin says privacy rules stop it from enrolling people automatically.

Item	Detail from the letter
Provider	Cyberscout (TransUnion)
Length	12 months
Enrollment	bfs.cyberscout.com/activate, with the code on the letter
Phone	844-784-5928, Monday to Friday, 8:00 AM to 8:00 PM Eastern

Why did I get a letter from Insightin Health?

Your health plan is an Insightin client. The letter calls Insightin a software company that provides services to its clients, and Washington's records name Centene Corporation and its Wellcare and Coordinated Care plans. The guide to letters from companies you never dealt with explains the chain.

What the documents leave open

• Which vendor's software had the flaw, and whether it has a public vulnerability identifier.
• Which health plans besides Centene's are involved.
• Why three Washington notices list email addresses and passwords.