Quantum Health data breach: a vishing call led to files taken from May 29 to June 1, 2026

Quantum Health, which runs healthcare navigation and care coordination for employers' self-insured health plans, says an intruder took files from its systems between May 29 and June 1, 2026, after one of its users responded to a vishing (voice phishing) call. The files held health plan members' names with health insurance and health information, and for some people possibly Social Security numbers. Washington's attorney general records 5,909 Washington residents notified; no filing in the log gives a nationwide total.

What happened and when

Quantum Health says it detected a service outage on June 1, 2026 that affected the availability of certain internal and external systems. Its investigation traced the outage to unauthorized access to its IT network that followed a user responding to a vishing call on May 29, 2026. Between May 29 and June 1, 2026, the intruder accessed and acquired files from some of its systems. The company says it reported the incident to federal law enforcement.

On July 8, 2026, the investigation found that some of those files held the recipient's information, and Quantum Health began notifying the health plans on July 27, 2026. Its Washington filing says clients began accepting its offer to notify their members on its behalf on July 29, 2026. Letters to individuals went out by first-class mail from July 29, 2026. The California copy of the letter was posted by the state's attorney general on October 27, 2026.

Date	What happened	Source
May 29, 2026	A user responds to a vishing call; unauthorized access begins	California letter
May 29 to June 1, 2026	Files accessed and acquired from Quantum Health systems	California letter
June 1, 2026	Service outage detected; systems isolated	California letter
July 8, 2026	Investigation finds recipients' information in the files	California letter
July 27, 2026	Quantum Health starts notifying client health plans	California letter
July 29, 2026	Letters to individuals start going out	Washington filing
August 14, 2026	Letters mailed to 5,909 Washington residents	Washington filing
October 27, 2026	California letter posted by the attorney general	California AG record

Who was affected and how many

The people involved are members of client companies' employer-sponsored health plans, plus current and former Quantum Health employees and their beneficiaries and dependents. On August 14, 2026, Quantum Health mailed notice letters to 5,909 Washington residents, citing HIPAA (45 CFR § 164.404) and Washington's breach law. Washington's attorney general lists the report on August 14, 2026 with a breach date of May 26, 2026, three days earlier than the vishing call date in the letters. Neither letter states how many people were notified across all states, so the total is unknown.

What information was involved

The files contained names with one or more of: health insurance information such as policy numbers or claims and benefits information; health information such as diagnoses, treatment information, prescriptions, provider names and dates of service; and other personal information such as date of birth, email, address, phone number or demographic information. Quantum Health says it could not rule out that Social Security numbers were also involved. Washington's record lists name, Social Security number, full date of birth, health insurance policy or ID number and medical information as compromised for its residents.

What Quantum Health is offering

Recipients are offered identity monitoring through Kroll at no cost, covering credit monitoring, fraud consultation and identity theft restoration. The length of the service and the activation deadline are left as blank template fields in both filed copies, so the number of months is unknown. Enrollment is at Enroll.krollmonitoring.com/redeem with the activation code in the letter. The letter's question line is (844) 958-8913, Monday to Friday, 9:00 a.m. to 6:30 p.m. ET.

Why am I getting a letter from Quantum Health?

Quantum Health works for employers, not for individuals directly, so most recipients have never dealt with it by name. If your employer's self-insured health plan uses Quantum Health for care navigation, your plan data may have been in the files taken, and Quantum Health is writing on the plan's behalf. The guide to breach letters from companies you never dealt with covers this vendor pattern across other notices in the log.

What the filings leave open

Neither filing gives a nationwide count, the length of the monitoring offer or any finding about misuse of the data. The log has no follow-up notice yet.