The Minnesota Health Insurance Network 2026 data breach involved unauthorized access to the health-insurance broker's network from March 16 through March 17, 2026, and removal of a limited amount of personal information. The organization opened an investigation with outside cybersecurity specialists, and its comprehensive document review concluded June 4.
The company's official notice confirms that full names were removed with person-dependent combinations of SSNs, driver's-license or state-ID numbers, other government IDs, dates of birth, financial-account information, credit or debit card information, medical treatment or diagnosis information, and health-insurance policy information. No nationwide affected-person total was published.
How Was the Minnesota Health Insurance Network Breach Confirmed?
The strongest primary source is Minnesota Health Insurance Network's “Notifies Affected Individuals of Information Security Incident” PDF on its own domain. It describes the two-day access window, June 4 review result, removal of data from the network, detailed information categories, written notifications beginning around July 15, and the assistance line at 888-289-7187.
The recipient letter in the Massachusetts consumer-notification archive supports the organization's account, its policy-brokerage context with Blue Cross and Blue Shield of Minnesota, and the protection offer. Claim Depot also links the official material to the company profile and summarizes the dates and data categories. The sources align on the incident and scope; none publishes a national population total.
What Happened From March 16 Through March 17, 2026?
The organization determined that unauthorized access to its network occurred between March 16 and March 17. Its review with outside experts analyzed the extent of information at risk. A comprehensive document review completed June 4 found that a limited amount of personal information had been removed from the network in connection with the incident. This is stronger than a finding of possible viewing alone.
The public documents do not disclose the initial-access method, account or vulnerability used, actor identity, ransomware, data volume, or whether the removed files were published. The two-day access period is substantiated, but the way it began remains unknown. LeakData does not add an actor, malware family, or technical cause absent from the sources.
What Identity and Financial Information Was Affected?
Possible identity fields were full names, Social security numbers, driver's-license or state-identification numbers, other government-identification numbers, and dates of birth. Financial categories included financial-account information and credit or debit card information. The official notice does not say every person had every field; “one or more” means the combination varied by recipient.
The sources do not separately confirm a bank name, routing number, balance, card expiration date, CVV, PIN, online-banking password, email address, or account password. Risk analysis should therefore remain within the published categories rather than inventing subfields. A recipient should use the information section of the individual letter as the authoritative statement of personal scope.
What Risks Come From Health and Insurance Data?
Medical treatment or diagnosis information may associate a person with a condition or service, while health-insurance policy information may let an attacker frame communications around an actual insurance relationship. Together, those details may make fake provider calls, benefit updates, premium requests, or medical-billing messages more persuasive.
The public notice does not separately list prescriptions, laboratory results, medical images, physician names, service dates, Medicaid or Medicare numbers, member IDs, or detailed clinical notes. Recipients should review explanations of benefits for unfamiliar services, providers, or policy changes and verify suspicious entries through an independently obtained official channel for the insurer or healthcare organization.
How Did the Organization Respond?
Minnesota Health Insurance Network engaged outside cybersecurity specialists and said it continued evaluating and improving its practices and internal controls. Around July 15 it began written notification to potentially affected people for whom it had a last known home address. As of the notice, it was unaware of reports of identity fraud or improper use directly resulting from the incident.
People whose SSNs were affected received complimentary Equifax Credit Watch Gold monitoring, while the notice appendix explained credit freezes, fraud alerts, free credit reports, and medical-identity precautions. The activation deadline is October 31, 2026. The dedicated line at 888-289-7187 is available weekdays from 9 a.m. to 9 p.m. Eastern Time.
How Many People Were Affected and What Should Recipients Do?
The organization and regulator sources confirm the notification process but do not publish a deduplicated nationwide total. Company customer, policy, or partner volumes cannot substitute for a victim count. The affected population is therefore recorded as undisclosed; LeakData holds no raw person files or searchable individual records for this event.
A recipient should first identify the fields listed in the personal notice. For an SSN or government ID, consider a credit freeze, fraud alert, and IRS IP PIN; for financial data, monitor transactions and discuss account security with the institution; for health data, review benefit statements. Even a caller quoting accurate fields is not authenticated, so do not provide full identifiers or one-time codes.
