Breachesby GlyphEpisource
Disclosed Jun 6, 20256,725,572 affectedConfirmed
Ransomware attack on Episource exposes health data of 6.7 million
Medical coding and billing firm Episource, owned by UnitedHealth's Optum, said a criminal could see and copy patient and member data from its systems during a weeklong intrusion that ended February 6, 2025; it first reported 5,418,866 affected people to HHS, later raised to 6,725,572.
What is known
| People affected | 6,725,572 (as reported to HHS) |
|---|---|
| Disclosed | Jun 6, 2025 |
| Discovered | Feb 6, 2025 |
| Happened | Jan 27, 2025 |
| Attack | Ransomware |
| Data exposed | NamesHealthAddressesDates of birthSocial Security numbersInsurance |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
California Attorney General breach notice: EpisourceWashington Attorney General breach notice: EpisourceOregon DOJ breach notice: EpisourceHHS OCR breach report: Episource (Business Associate, CA)Episource is notifying millions of people that their health data was stolenHealthcare SaaS firm says data breach impacts 5.4 million patientsJune 2025 Healthcare Data Breach ReportLargest Healthcare Data Breaches of 2025Texas Attorney General data security breach report BR-0004825: EpisourceVermont Attorney General: 2025-07-11 Episource Data Breach Notice to Consumers
Notices filed
California AGCount not statedWashington AG102,913 peopleOregon DOJ5,418,866 peopleHHS OCR6,725,572 peopleResearch6,725,572 peopleCalifornia AGCount not statedVermont AGCount not statedCalifornia AGCount not statedCalifornia AGCount not statedCalifornia AGCount not statedCalifornia AGCount not statedCalifornia AGCount not statedCalifornia AGCount not statedCalifornia AGCount not statedOregon DOJ6,584,876 peopleCalifornia AGCount not statedTexas AG351,562 people
Other breaches at Episource
History of this record
empty to https://ago.vermont.gov/document/2025-07-11-episource-data-breach-notice-consumersby backfillSource
empty to https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPageby backfillSource
["names","health"] to ["names","health","addresses","dob","ssn","insurance"]by seedSource
empty to Medical coding and billing firm Episource, owned by UnitedHealth's Optum, said a criminal could see and copy patient and member data from its systems during a weeklong intrusion that ended February 6, 2025; it first reported 5,418,866 affecby seedSource
empty to Ransomware attack on Episource exposes health data of 6.7 millionby seedSource
[] to ["names","health"]by backfillSource
empty to hhsby backfillSource
empty to 6725572by backfillSource
other to healthby backfillSource
unknown to ransomwareby backfillSource
empty to 2025-02-06by backfillSource
2025-07-11 to 2025-06-06by backfillSource
2025-07-31 to 2025-07-11by backfillSource
2025-08-22 to 2025-07-31by backfillSource
2025-09-11 to 2025-08-22by backfillSource
2025-09-22 to 2025-09-11by backfillSource
2025-10-01 to 2025-09-22by backfillSource
2025-10-15 to 2025-10-01by backfillSource
2025-11-12 to 2025-10-15by backfillSource
2026-02-09 to 2025-11-12by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.