MedImpact data breach: the October 2025 ransomware attack on the pharmacy benefit manager

Oregon's Department of Justice records the first count: 327,082 people, with a breach date and discovery date of October 18, 2025, notice on September 25, 2026 and a report to the state on September 26, 2026. Notice came 342 days after the ransomware was found.

What happened in the MedImpact ransomware attack?

MedImpact's letter, as filed with California, says that on October 18, 2025 it identified unauthorized activity within certain systems, secured them, and brought in cybersecurity experts. The company's statement nine days later, dated in San Diego and describing "a system outage", said MedImpact was restoring the affected systems in a new environment kept apart from the old infrastructure, and that claims for all clients were going through again.

The Qilin ransomware group claimed the attack and listed MedImpact on its leak site in October 2025, The HIPAA Journal reported, saying it had taken data and would publish it if not paid. MedImpact's own documents do not name a group.

Date	What happened	Source
October 18, 2025	MedImpact finds unauthorized activity; California's breach date	Letter; California list
October 2025	Qilin lists MedImpact on its leak site	HIPAA Journal
October 27, 2025	Statement: ransomware found; claims for all clients adjudicating	MedImpact
July 17, 2026	Investigation finished	HIPAA Journal
August 13, 2026	Affected clients told	HIPAA Journal
September 23, 2026	Letters to individuals begin	HIPAA Journal
September 25, 2026	Notice recorded by California	California list

From the day MedImpact found the activity to the first letters took 340 days. Part of that time went on a step only vendors have: MedImpact told its affected clients on August 13, 2026, about six weeks before the letters, per The HIPAA Journal. The notice-delay guide shows how 340 days compares with other notices.

Why did I get a MedImpact letter if I never dealt with MedImpact?

Because MedImpact runs pharmacy benefits for health plans, government bodies and self-insured employers, so most people know it only through their plan. The letter says it plainly: MedImpact is a pharmacy benefits manager that provides services to your health plan. The HIPAA Journal reports that the letters were sent by MedImpact on behalf of its affected clients, and that the clients and the number of people have not been made public. If your plan's pharmacy card or mail-order service runs through MedImpact, that is the link.

What information was exposed in the MedImpact breach?

It varied by person; the letter says so and fills in each person's own list. The HIPAA Journal's summary of the notices lists names together with some or all of: address, date of birth, subscriber number, Social Security number, health insurance information, and health information such as prescriptions, treatment, dates of service, service locations and provider names. For a pharmacy benefit manager the prescription data is the core of the record, which is why this breach matters even to people whose Social Security number was not in it.

How many people were affected by the MedImpact breach?

327,082, per Oregon's breach list. California's record and the letter give no count, and The HIPAA Journal reported none. California's list has one MedImpact notice, with a breach date of October 18, 2025 and a reported date of September 25, 2026. The count may appear later on the federal health breach portal or in a state that publishes totals; this entry will add it if one is filed.

Texas's attorney general lists a report from MedImpact Healthcare Systems, Inc., posted on September 29, 2026, with 8,199 Texans affected. The Texas record lists names, addresses, Social Security numbers, medical information, health insurance information and dates of birth among the information involved. The Texas ranking lists 2026's largest reports. The figure counts Texans only.

What is MedImpact offering?

Identity monitoring through Kroll at no cost, covering credit monitoring, fraud consultation and identity theft restoration, for a number of months printed on each letter. Enrollment runs at the Kroll site with the membership number on the letter, by the deadline the letter gives. The HIPAA Journal says the offer went to people whose Social Security numbers were involved. The guide to credit monitoring offers compares it with other offers, and the largest health data breaches reported to HHS in 2026 puts health-plan vendor breaches in context.

How many Washingtonians were affected by the MedImpact breach?

Washington's attorney general lists a notice from MedImpact Healthcare Systems, Inc., reported on September 26, 2026, with a breach date of October 18, 2025 and 3,926 Washingtonians affected. The record lists names, Social Security numbers, full dates of birth, health insurance policy or ID numbers, medical information and protected health information held for a HIPAA covered entity as the information compromised. The Washington ranking compares 2026's notices. The figure counts Washington residents only.

What the record leaves open

• How many people were affected, and which health plans they belong to.
• How the attacker got into MedImpact's systems.
• Whether a ransom was asked for or paid, and whether Qilin published the data.