TriZetto Provider Solutions breach: an insurance eligibility portal accessed for 11 months

What happened in the TriZetto Provider Solutions breach?

The portal is one that some of the company's healthcare provider customers use to reach its systems. TriZetto Provider Solutions (TPS) says the unauthorized actor began accessing some records tied to insurance eligibility verification, the checks providers run to see whether a patient's insurance covers a treatment. The company says it launched an investigation, brought in outside cybersecurity experts and notified law enforcement.

TPS is a subsidiary of Cognizant: Cognizant's annual report for 2025 lists TriZetto Provider Solutions, LLC among its subsidiaries.

Date	What the letter and the regulators' records say
November 2024	The unauthorized actor begins accessing records; Washington's list and California's record give November 19, 2024 as a breach date
October 2, 2025	TPS becomes aware of suspicious activity in the portal; Indiana's report gives this as the breach date
On or around November 28, 2025	TPS learns what information the affected data may have included
December 9, 2025	TPS begins notifying the affected healthcare providers
February 6, 2026	Report submitted to HHS; report recorded by Washington; Indiana's report gives this as the date notice was sent
February 11, 2026	Notice recorded by California's attorney general; report logged in Massachusetts
June 2, 2026	Posted on the Texas attorney general's list

The access ran for about 11 months before it was found. From the discovery to the first regulator records took 127 days, and 59 days passed between the start of notices to providers and the HHS report. The notice delay study shows how such gaps compare.

What information was involved?

TPS says it learned on or around November 28, 2025 that the affected data may have included each person's name, address, date of birth, Social Security number, health insurance member number (for some people a Medicare beneficiary identifier), provider name, health insurer name, primary insured information and other demographic, health and insurance information.

The letter says the incident did not affect payment card, bank account or other financial information. Washington's list, however, includes "Financial & Banking Information" among the types for this report, while Massachusetts marks financial accounts and payment cards as not breached. The documents do not explain the difference.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	3,433,965
Indiana attorney general	Total affected, as reported to Indiana	3,433,965
Indiana attorney general	Indiana residents	7,155
Texas attorney general	Texans	312,562
Washington attorney general	Washingtonians	76,562
Massachusetts consumer affairs office	Massachusetts residents	48,857

HHS and Indiana give the same total. The report is the seventh largest in the Washington ranking and the fourth largest 2026 business associate report among the federal list's open cases. Because TPS works for providers, patients may also hear about the breach from their own clinic or hospital: California's list carries a separate notice from CE-Edinger Medical Group that names TPS.

Why did I get a letter from TriZetto Provider Solutions?

TPS says it provides billing-related services to healthcare providers, including the recipient's own provider. Most patients have never dealt with TPS directly; the guide to letters from companies you never dealt with explains the vendor chain, and the HIPAA Breach Notification Rule entry sets out what a business associate must do.

What is TPS offering people who got a letter?

TPS offers Kroll single-bureau credit monitoring, a credit report and a credit score at no charge, plus fraud assistance. The filed letter leaves the length in months, the enrollment deadline and the call center number as blank fields, so each recipient's letter carries its own.

Item	Detail from the letter
Provider	Kroll
Services	Single-bureau credit monitoring, credit report and credit score; fraud assistance
Enrollment	enroll.krollmonitoring.com, with the unique code printed on the letter
Length and deadline	Printed on each letter (blank in the filed copy)
Call center hours	Monday to Friday, 8:00 a.m. to 5:30 p.m. Central Time, excluding major U.S. holidays
Other languages	tpsincident.kroll.com

Enrollment needs an internet connection and an email account, and the letter says it may not be available to people under 18. The credit monitoring offers guide compares other notices.

What the documents leave open

• How the unauthorized actor got into the portal, and whether the records were copied or only viewed.
• Why the access went unnoticed from November 2024 to October 2025.
• Why Washington's list names financial and banking information when the letter says none was affected.
• How many providers' patients are involved; the letter does not name the providers.

Is the TriZetto Provider Solutions letter a scam?

TPS filed a sample of the letter with California's attorney general, and the federal, Texas, Washington, Massachusetts and Indiana records all list the breach. A genuine letter sends readers to enroll.krollmonitoring.com and to tpsincident.kroll.com for other languages.

Was my Social Security number exposed in the TriZetto breach?

The letter lists Social Security numbers among the information that may have been involved, and Texas, Washington and Massachusetts record them too. The letter does not say that every person's number was involved.