Incident · State breach notice (California AG)
Marathon Health Notifies Individuals After Credential-Based Breach of Health Care Database
Published . By the cisonews.net Desk.
What the notice says
Marathon Health, which the notice describes as providing , filed a notice with the California Attorney General reporting an incident involving a back-end health care operations database. Marathon Health states that on August 24, 2026, it and disabled that account while starting an investigation with cybersecurity professionals. According to Marathon Health, . The notice says this activity . Marathon Health states that on September 9, 2026, it . The information involved varied by individual and could have included .
What the notice leaves open
The version of the notice as filed uses placeholder text for the recipient's personal details and does not state a total number of individuals affected. It also does not specify how the impersonation of IT staff was carried out or how long the unauthorized access to the cloud-hosted application lasted beyond the stated hours on August 24, 2026.
Sources
- 2026-10-29 · AMarathon Health, notice filed with the California Attorney General, published October 29, 2026
- 2026-10-29 · ACalifornia Attorney General, data breach notification record, published October 29, 2026
Tier A: the organization itself (including notices it filed with a state attorney general), a regulator or SEC EDGAR. Tier B: established press. Each fact on this page carries its supporting passage in the page source.
See an error? Corrections are made on the page and logged on the corrections page. Send them through contact.