Insightin Health insightinhealth.com Insightin Health data breach: what happened and what to do
Insightin Health, a health plan analytics company, notified people in 2026 of a breach that began in September 2025 through a GoAnywhere flaw. HHS lists 1,949,534 people. Exposed: names, dates of birth and Medicare Beneficiary Identifiers. Not SSNs, per the notice.
View all 13,115 breaches- Breach date
- 17 Sept 2025
- Made public
- 4 Mar 2026
- Affected
- 1,949,534
- Data exposed
- Names, Dates of birth, Health insurance information
- Last updated
What happened
Insightin Health is a company that does data analytics for health plans. Between September 17 and September 23, 2025, an unauthorized party reached data on some of its servers. According to Insightin's notice, the way in was a flaw in GoAnywhere, a file-transfer tool the company used to exchange files with health plans.
The U.S. Department of Health and Human Services (HHS) lists the breach as affecting 1,949,534 people. Insightin's notice letter, filed with the California Attorney General and dated March 4, 2026, went out months after the intrusion. The Medusa ransomware group claimed the attack and said it had taken 378 GB of data, according to security news coverage. Insightin's notice doesn't name the attackers.
What was exposed
Reporting on the notice says the files held names, dates of birth, contract numbers, health insurance providers' non-unique identifiers, Medicare Beneficiary Identifiers and information about the providers people were attributed to. The notice says Social Security numbers were not involved. What you were affected by depends on your health plan, so the letter you received is the authority on your own details.
What that lets criminals do
A Medicare Beneficiary Identifier is the number on a Medicare card. With a name and date of birth it can be used for medical identity theft: billing Medicare for care you never got, or getting services in your name. That can leave wrong entries in your records and surprise bills.
Names, dates of birth and health plan details also make phishing more believable. A caller who knows your plan and your birthday sounds like your insurer. Because Social Security numbers weren't part of this, a credit freeze is less urgent here than in most health breaches, though it's free and worth having anyway.
Why a vendor breach reaches you
You may never have heard of Insightin Health. Health plans hire companies like it to analyze member data, and the data travels between them in files. That's why this breach shows up in letters from insurers or plans rather than from the company itself. The GoAnywhere flaw affected many organizations that used the tool, so a letter from Insightin doesn't mean your own plan was careless. It means a supplier in the chain was.
The gap also matters. The intrusion lasted from September 17 to 23, 2025, and the notice letter is dated March 4, 2026, about five months later. Any misuse of your identifiers could have started in that window, so a check of your recent statements is worth doing now.
The company's response
Insightin offered affected people 12 months of complimentary credit monitoring and identity theft protection. This is reported to be the company's second security incident in two years.
What to do
Check your Medicare and insurer statements first, since that's where misuse of these identifiers shows up. Then be wary of anyone who contacts you about your plan or Medicare. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak. It can't remove data from a breach, so the practical protection is in the steps below.
What to do if you were in it
- 1
Read your Medicare and insurance statements
Look for services or claims you didn't receive. Report them to your plan or to Medicare.
- 2
Treat calls about your plan or Medicare as suspect
Scammers use plan details to sound legitimate. Hang up and call the number on your card.
- 3
Take the free credit monitoring
Insightin offered 12 months. Activate it with the code in your letter.
- 4
Consider a credit freeze
Your SSN wasn't exposed here, but a free freeze at Equifax, Experian and TransUnion is cheap protection against identity theft in general.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see where else your details have leaked.
Frequently asked
Was I affected by the Insightin Health breach?
Insightin sent notices to affected people through their health plans. If you got a letter, your data was involved.
Were Social Security numbers exposed?
The notice says no. Names, dates of birth, contract numbers, plan identifiers and Medicare Beneficiary Identifiers were reported.
Who was behind the attack?
The notice doesn't name anyone. Security news reports that the Medusa ransomware group claimed it.
Should I replace my Medicare card?
If your Medicare Beneficiary Identifier was exposed, you can ask Medicare about a new card. Check with Medicare directly.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
