Magellan Health
Disclosed May 11, 20206 years ago1,650,500 affectedConfirmed
The covered entity (CE), Magellan Health, reported that an employee was the victim of an email phishing scheme that affected the electronic protected health information (ePHI) of approximately 1,013,956 individuals. The ePHI involved included names, addresses, Social Security numbers, health insurance information, and other treatment information. In its mitigation efforts, the CE implemented additional administrative, technical, and security safeguards to better protect its ePHI.
What is known
| People affected | 1,650,500 (as reported by the organization) |
|---|---|
| Disclosed | May 11, 2020 |
| Discovered | Apr 11, 2020 |
| Happened | Apr 6, 2020 |
| Attack | Ransomware |
| Data exposed | Names, Health, Credentials and tokens, Social Security numbers, Payment cards, Financial |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Magellan Healthoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Magellan Healthatg.wa.gov · Official notice | Official notice |
| Delaware DOJ breach notice: Magellan Healthattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Magellan Healthjustice.oregon.gov · Official notice | Official notice |
| Indiana Attorney General 2020 data breach report: Magellan Healthin.gov · Official notice | Official notice |
| Maine Attorney General breach notice archive: Magellan Healthmaine.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Magellan Health (Health Plan, AZ)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | May 11, 2020 | |
| Washington AGresidents of WA | May 11, 2020 | 5,119 |
| Oregon DOJresidents of OR | May 11, 2020 | 106,473 |
| Indiana AGresidents of IN | May 11, 2020 | 5,158 |
| Maine AGresidents of ME | May 11, 2020 | |
| California AGresidents of CA | Jun 12, 2020 | |
| Maine AGresidents of ME | Jun 12, 2020 | 2,231 |
| HHS archivetotal | Jun 12, 2020 | 1,013,956 |
| Delaware DOJresidents of DE | Jun 15, 2020 | 2,237 |
History of this record
- 2026-09-25 · summary: empty to The covered entity (CE), Magellan Health, reported that an employee was the victim of an email phishing scheme that affected the electronic protected health information (ePHI) of approximately 1,013,956 individuals. The ePHI involved includ · backfill source
- 2026-09-25 · data_types: ["names","health","credentials"] to ["names","health","credentials","ssn","payment-card","financial"] · backfill source
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2020.pdf · backfill source
- 2026-09-25 · data_types: [] to ["names","health","credentials"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 1650500 · backfill source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2020-04-11 · backfill source
- 2026-09-25 · disclosed: 2020-06-12 to 2020-05-11 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.