Sunshine Health 2026 Data Breach (41.6 Thousand People Affected)

The 2026 Sunshine Health data breach occurred when a caller pretending to be a trusted individual misled an employee into sharing a limited number of health-plan files with an unauthorized party. Sunshine Health says it learned of the event on May 6, 2026.

The U.S. Department of Health and Human Services Office for Civil Rights recorded the Sunshine Health event as a hacking/IT incident and reported 41,569 affected individuals.

Verified Incident Timeline

After learning of the event on May 6, Sunshine Health says it began an investigation, brought in outside experts, and notified law enforcement. The HHS entry was submitted on July 10, 2026. Sunshine Health's homepage also directs members to the detailed incident notice.

What Information May Have Been Affected?

The information varied by person but may have included member names and one or more of the following: dates of birth, medical information or history, and health-plan coverage information. The notice does not say that every field applied to every person, and it does not support inferring additional identity or payment data.

How Sunshine Health Responded

The organization says it implemented additional employee training and increased awareness of methods unauthorized people may use to access data or systems. As of the notice date, it said there was no evidence that the information had been misused or used for fraud. Affected people were offered complimentary credit monitoring and identity-theft protection services.

What Should Affected People Do?

Notice recipients should activate the offered protection service within the deadline in their letter and review health-plan records and credit reports for activity they do not recognize. Incident links and contact details should be verified through Sunshine Health's official website before use.