Episource
Disclosed Jun 6, 20251 year ago6,725,572 affectedConfirmed
Ransomware attack on Episource exposes health data of 6.7 million
Medical coding and billing firm Episource, owned by UnitedHealth's Optum, said a criminal could see and copy patient and member data from its systems during a weeklong intrusion that ended February 6, 2025; it first reported 5,418,866 affected people to HHS, later raised to 6,725,572.
What is known
| People affected | 6,725,572 (as reported to HHS) |
|---|---|
| Disclosed | Jun 6, 2025 |
| Discovered | Feb 6, 2025 |
| Happened | Jan 27, 2025 |
| Attack | Ransomware |
| Data exposed | Names, Health, Addresses, Dates of birth, Social Security numbers, Insurance |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Episourceoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Episourceatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Episourcejustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report: Episource (Business Associate, CA)ocrportal.hhs.gov · Official notice | Official notice |
| Episource is notifying millions of people that their health data was stolentechcrunch.com · News | News |
| Healthcare SaaS firm says data breach impacts 5.4 million patientsbleepingcomputer.com · News | News |
| June 2025 Healthcare Data Breach Reporthipaajournal.com · News | News |
| Largest Healthcare Data Breaches of 2025hipaajournal.com · News | News |
| Texas Attorney General data security breach report BR-0004825: Episourceoag.my.site.com · Official notice | Official notice |
| Vermont Attorney General: 2025-07-11 Episource Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Jun 6, 2025 | |
| Washington AGresidents of WA | Jun 6, 2025 | 102,913 |
| Oregon DOJresidents of OR | Jun 6, 2025 | 5,418,866 |
| HHS OCRtotal | Jun 6, 2025 | 6,725,572 |
| Researchtotal | Jun 6, 2025 | 6,725,572 |
| California AGresidents of CA | Jul 11, 2025 | |
| Vermont AGresidents of VT | Jul 11, 2025 | |
| California AGresidents of CA | Jul 31, 2025 | |
| California AGresidents of CA | Aug 22, 2025 | |
| California AGresidents of CA | Sep 11, 2025 | |
| California AGresidents of CA | Sep 22, 2025 | |
| California AGresidents of CA | Oct 1, 2025 | |
| California AGresidents of CA | Oct 15, 2025 | |
| California AGresidents of CA | Nov 12, 2025 | |
| Oregon DOJresidents of OR | Dec 11, 2025 | 6,584,876 |
| California AGresidents of CA | Feb 9 | |
| Texas AGresidents of TX | Feb 11 | 351,562 |
Other breaches at Episource
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Jun 2, 2023Jun 2, 20233 years agoHacking | Jun 2, 20233 years ago | Hacking | Healthcare | Confirmed | 24K |
History of this record
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2025-07-11-episource-data-breach-notice-consumers · backfill source
- 2026-09-25 · source: empty to https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage · backfill source
- 2026-09-25 · data_types: ["names","health"] to ["names","health","addresses","dob","ssn","insurance"] · seed source
- 2026-09-25 · summary: empty to Medical coding and billing firm Episource, owned by UnitedHealth's Optum, said a criminal could see and copy patient and member data from its systems during a weeklong intrusion that ended February 6, 2025; it first reported 5,418,866 affec · seed source
- 2026-09-25 · title: empty to Ransomware attack on Episource exposes health data of 6.7 million · seed source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 6725572 · backfill source
- 2026-09-25 · sector: other to health · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2025-02-06 · backfill source
- 2026-09-25 · disclosed: 2025-07-11 to 2025-06-06 · backfill source
- 2026-09-25 · disclosed: 2025-07-31 to 2025-07-11 · backfill source
- 2026-09-25 · disclosed: 2025-08-22 to 2025-07-31 · backfill source
- 2026-09-25 · disclosed: 2025-09-11 to 2025-08-22 · backfill source
- 2026-09-25 · disclosed: 2025-09-22 to 2025-09-11 · backfill source
- 2026-09-25 · disclosed: 2025-10-01 to 2025-09-22 · backfill source
- 2026-09-25 · disclosed: 2025-10-15 to 2025-10-01 · backfill source
- 2026-09-25 · disclosed: 2025-11-12 to 2025-10-15 · backfill source
- 2026-09-25 · disclosed: 2026-02-09 to 2025-11-12 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.