Breachesby GlyphMagellan Health
Disclosed May 11, 20201,650,500 affectedConfirmed
The covered entity (CE), Magellan Health, reported that an employee was the victim of an email phishing scheme that affected the electronic protected health information (ePHI) of approximately 1,013,956 individuals. The ePHI involved included names, addresses, Social Security numbers, health insurance information, and other treatment information. In its mitigation efforts, the CE implemented additional administrative, technical, and security safeguards to better protect its ePHI.
What is known
| People affected | 1,650,500 (as reported by the organization) |
|---|---|
| Disclosed | May 11, 2020 |
| Discovered | Apr 11, 2020 |
| Happened | Apr 6, 2020 |
| Attack | Ransomware |
| Data exposed | NamesHealthCredentials and tokensSocial Security numbersPayment cardsFinancial |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
California Attorney General breach notice: Magellan HealthWashington Attorney General breach notice: Magellan HealthDelaware DOJ breach notice: Magellan HealthOregon DOJ breach notice: Magellan HealthIndiana Attorney General 2020 data breach report: Magellan HealthMaine Attorney General breach notice archive: Magellan HealthHHS OCR breach report (archive, resolved): Magellan Health (Health Plan, AZ)
Notices filed
History of this record
empty to The covered entity (CE), Magellan Health, reported that an employee was the victim of an email phishing scheme that affected the electronic protected health information (ePHI) of approximately 1,013,956 individuals. The ePHI involved includby backfillSource
["names","health","credentials"] to ["names","health","credentials","ssn","payment-card","financial"]by backfillSource
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2020.pdfby backfillSource
[] to ["names","health","credentials"]by backfillSource
empty to organizationby backfillSource
empty to 1650500by backfillSource
unknown to ransomwareby backfillSource
empty to 2020-04-11by backfillSource
2020-06-12 to 2020-05-11by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.