Episource episource.com Episource data breach: what happened and what to do
A criminal copied data from Episource, a medical coding vendor for health plans, between January 27 and February 6, 2025. About 5.4 million people were affected. Exposed data varied but included contact details, health insurance IDs, clinical information and, for some, Social Security numbers.
View all 13,115 breaches- Breach date
- 27 Jan 2025
- Data exposed
- Names, Physical addresses, Phone numbers, Email addresses, Dates of birth, Health insurance information, Medical records, Social security numbers, Driver's licenses
- Last updated
What happened
Episource is a company that does medical coding and risk adjustment for health plans and providers. Most people affected never dealt with it directly: their insurer or doctor's group hired it.
According to the notices, an unauthorized party got into Episource's systems and copied data between January 27 and February 6, 2025. Episource began notifying its customers in April 2025, and letters to individuals went out over the following months. Later letters reached members of some health plans through their insurers, which is why people received notices at different times. The breach shows up on the California Attorney General's breach list, and news outlets reporting on the federal filing put the total at about 5.4 million people.
Episource says it has no evidence the data has been misused, and that the incident did not involve financial account information.
What was exposed
What leaked depended on the person and on which health plan or provider Episource worked for. Based on the notices and reporting, it could include:
- Names, addresses, phone numbers, email addresses and dates of birth
- Health insurance details: plan and policy information, and member, group and government payer ID numbers
- Medical record numbers, diagnoses, medications, test results and treatment records
- For some people, Social Security numbers and driver's license or state ID numbers
One customer, Sharp HealthCare, said its patients' data did not include Social Security numbers or financial information. So read your own letter: it lists exactly what applies to you.
What that lets criminals do
Contact details plus a health plan name make phishing believable. A message that mentions your insurer and a real plan ID looks like billing or a claims problem, and people click. Health insurance IDs can also be used for medical identity theft, where someone gets care or files claims in your name. That can show up later as a bill or a claim you don't recognize.
If your Social Security number or driver's license number was in the file, the bigger risk is new credit opened in your name. Medical details can't be changed the way a password can, so they're worth guarding mainly by watching for misuse.
What the company did
Episource notified affected customers and individuals, and its notices say it took steps to secure its systems. If your letter includes a credit monitoring code, use it: it costs nothing and the enrollment deadline is printed on the letter.
What to expect next
Notices from this breach arrived over many months, so a letter showing up now doesn't mean something new happened. If you have coverage through a plan that used Episource, check your insurer's website for a notice page: several, including Sharp HealthCare, posted their own.
Keep the letter. If a fraud problem appears later, a dated notice is useful proof when you dispute a charge, a claim or a credit account. And because health data doesn't expire, treat unexpected calls about your coverage with suspicion well beyond the first few weeks.
What to do if you were in it
- 1
Read your notice and note what applies to you
The letter lists which data types were in your file and whether Social Security numbers were involved. That decides which of the steps below matter most.
- 2
Freeze your credit at all three bureaus
A freeze is free and stops anyone opening new credit in your name. Do it at Equifax, Experian and TransUnion (each one separately). You can lift it temporarily when you apply for a loan.
- 3
Read every explanation of benefits
Check statements from your insurer for services or providers you don't recognize. Report anything odd to the insurer's fraud line straight away.
- 4
Treat messages that mention your health plan as suspect
Don't click links or call numbers in texts or emails about claims or billing. Go to your insurer's website or call the number on your member card.
- 5
Accept the free credit monitoring if it's offered
Use the enrollment code from your letter before the deadline it gives.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, with what to do next. It can't take data out of a breach, so the alert is what lets you act early.
Frequently asked
Was I affected by the Episource breach?
If Episource or your health plan sent you a notice letter, yes. Episource worked for many plans and providers, so a letter may come from your insurer rather than Episource.
What data was exposed in the Episource breach?
It varied by person: contact details, dates of birth, health insurance information and clinical details, plus Social Security numbers or driver's license numbers for some people. Your letter says which.
How many people were affected?
About 5.4 million, according to reporting on the federal breach filing.
Should I freeze my credit?
If your notice says your Social Security number was involved, yes. It's free and takes a few minutes at each of the three bureaus.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
