Insightin Health 2025 Data Breach

Insightin Health described suspicious network activity and its third-party investigation in a substitute notice. The forensic review confirmed unauthorized access between September 17 and September 23, 2025. File review showed that protected health information associated with its clients was present in affected files, making the event a genuine regulated health-data breach.

The HHS OCR entry classifies Insightin Health as a Business Associate, the event as a Hacking/IT Incident, and the information location as Network Server. HIPAA Journal reviewed the organization notice and incident context, corroborating the access range, data types, and protection offer. Sources specifically state that Social Security numbers were not compromised.

Verified network access began on September 17, 2025 and ended on September 23. The incident date is based on the earliest technical activity that can be verified from public sources. Insightin detected unusual activity in September and opened a forensic review to determine the nature, scope, and affected files.

The HHS row carries a January 16, 2026 submission date and now shows 1,949,534 people. Public sources do not disclose when every client was notified or provide health-plan-level subtotals.

Files could contain names and dates of birth. Contract numbers and non-unique identifiers used by health-insurance providers were also in the disclosed scope. These fields can support phishing and insurance-account fraud, but a non-unique provider identifier is not itself a personal account password.

Medicare beneficiary identifiers were present in some files. Insightin also disclosed information associated with healthcare providers attributed to individuals. This combination can help attackers craft persuasive fake Medicare communications or messages based on a known provider relationship.

Insightin Health expressly said Social Security numbers were not compromised. Sources also do not list payment cards, bank accounts, account passwords, diagnoses, detailed treatment notes, or prescription information among the confirmed general fields.

The data combination may vary by person and Insightin client; the record does not imply that every field appeared for all 1,949,534 people. The phrase “protected health information” is not used to infer undisclosed clinical details.

The Medusa ransomware group claimed responsibility, asserting that it exfiltrated 378 GB from Insightin's network and threatening to publish the data. Those details did not appear in the organization's substitute notice. Public sources do not show that Insightin confirmed Medusa's name, the file volume, a ransom demand, or the entire claimed content.

The reliable core is company-confirmed network access and file scope plus the HHS population of 1,949,534. The attacker assertion is not used to broaden data categories.

Insightin Health offered affected people twelve months of complimentary credit monitoring and identity-theft protection. Although Social Security numbers were outside the scope, notice recipients should monitor credit reports, carefully verify messages claiming to represent a health plan or Medicare, and refuse information requests in unexpected calls seeking a beneficiary identifier.

An unfamiliar provider, service, or claim in Medicare and health-insurance statements should be reported through the plan's official fraud channel. Contact details should be obtained independently from a card or official website instead of following a message link. If a suspicious message or account event appears, it should be verified through the organization’s current official contact channel without using links in the message. When an individual notification letter is available, it is the primary source for the person-specific data scope and protection options offered. Dates and data categories should be interpreted only to the extent supported by public sources; undisclosed details should not be treated as confirmed.