Sunshine Health 2026 Data Breach
The 2026 Sunshine Health data breach occurred when a caller pretending to be a trusted individual misled an employee into sharing a limited number of health-plan files with an unauthorized party. Sunshine Health says it learned of the event on May 6, 2026.
Exposed Data Types
2 sensitive4- Medical information
- Health insurance information
- Names
- Dates of birth
About This Breach
The U.S. Department of Health and Human Services Office for Civil Rights recorded the Sunshine Health event as a hacking/IT incident and reported 41,569 affected individuals.
Verified Incident Timeline
After learning of the event on May 6, Sunshine Health says it began an investigation, brought in outside experts, and notified law enforcement. The HHS entry was submitted on July 10, 2026. Sunshine Health's homepage also directs members to the detailed incident notice.
What Information May Have Been Affected?
The information varied by person but may have included member names and one or more of the following: dates of birth, medical information or history, and health-plan coverage information. The notice does not say that every field applied to every person, and it does not support inferring additional identity or payment data.
How Sunshine Health Responded
The organization says it implemented additional employee training and increased awareness of methods unauthorized people may use to access data or systems. As of the notice date, it said there was no evidence that the information had been misused or used for fraud. Affected people were offered complimentary credit monitoring and identity-theft protection services.
What Should Affected People Do?
Notice recipients should activate the offered protection service within the deadline in their letter and review health-plan records and credit reports for activity they do not recognize. Incident links and contact details should be verified through Sunshine Health's official website before use.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
