Every public data breach

Disclosed this week47On record26,367

47 disclosed this week · 26,367 on record

Magellan Health

Disclosed May 11, 20201,650,500 affectedConfirmed

Official notice

The covered entity (CE), Magellan Health, reported that an employee was the victim of an email phishing scheme that affected the electronic protected health information (ePHI) of approximately 1,013,956 individuals. The ePHI involved included names, addresses, Social Security numbers, health insurance information, and other treatment information. In its mitigation efforts, the CE implemented additional administrative, technical, and security safeguards to better protect its ePHI.

What is known

People affected1,650,500 (as reported by the organization)
DisclosedMay 11, 2020
DiscoveredApr 11, 2020
HappenedApr 6, 2020
AttackRansomware
Data exposedNamesHealthCredentials and tokensSocial Security numbersPayment cardsFinancial
SectorHealthcare · US
StatusConfirmed

Sources

Official noticeoag.ca.gov
California Attorney General breach notice: Magellan Health
Official noticeatg.wa.gov
Washington Attorney General breach notice: Magellan Health
Official noticeattorneygeneral.delaware.gov
Delaware DOJ breach notice: Magellan Health
Official noticejustice.oregon.gov
Oregon DOJ breach notice: Magellan Health
Official noticein.gov
Indiana Attorney General 2020 data breach report: Magellan Health
Official noticemaine.gov
Maine Attorney General breach notice archive: Magellan Health
Official noticeocrportal.hhs.gov
HHS OCR breach report (archive, resolved): Magellan Health (Health Plan, AZ)

Notices filed

Residents of CAMay 11, 2020
California AGCount not stated
Residents of WAMay 11, 2020
Washington AG5,119 people
Residents of ORMay 11, 2020
Oregon DOJ106,473 people
Residents of INMay 11, 2020
Indiana AG5,158 people
Residents of MEMay 11, 2020
Maine AGCount not stated
Residents of CAJun 12, 2020
California AGCount not stated
Residents of MEJun 12, 2020
Maine AG2,231 people
TotalJun 12, 2020
HHS archive1,013,956 people
Residents of DEJun 15, 2020
Delaware DOJ2,237 people
History of this record
summary2026-09-25
empty to The covered entity (CE), Magellan Health, reported that an employee was the victim of an email phishing scheme that affected the electronic protected health information (ePHI) of approximately 1,013,956 individuals. The ePHI involved includby backfillSource
data_types2026-09-25
["names","health","credentials"] to ["names","health","credentials","ssn","payment-card","financial"]by backfillSource
source2026-09-25
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2020.pdfby backfillSource
data_types2026-09-25
[] to ["names","health","credentials"]by backfillSource
records_basis2026-09-25
empty to organizationby backfillSource
records2026-09-25
empty to 1650500by backfillSource
attack2026-09-25
unknown to ransomwareby backfillSource
discovered2026-09-25
empty to 2020-04-11by backfillSource
disclosed2026-09-25
2020-06-12 to 2020-05-11by backfillSource
Added2026-09-25
First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Magellan Health