Magellan Health data breach: what happened and what to do

Magellan Health reported a 2020 phishing attack to HHS affecting about 1,013,956 people. Names, addresses, Social Security numbers, health insurance information and treatment information were involved. A ransomware attack was found on April 11, 2020.

View all 13,177 breaches

Breach date: 6 Apr 2020
Made public: 11 May 2020
Affected: 1,013,956
Data exposed: Names, Physical addresses, Social security numbers, Health insurance information, Treatment information
Last updated: 27 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Magellan Health, a U.S. health care company, said it found it had been hit by a ransomware attack on April 11, 2020. Its notice, as reported by Security Affairs, says the attacker got in through a phishing email sent on April 6 that impersonated a Magellan client. The attacker stole a subset of data from a single corporate server. For some current employees, the attacker also used malware designed to steal logins and passwords.

Magellan told HHS the incident affected the electronic protected health information of approximately 1,013,956 people. HHS says that information included names, addresses, Social Security numbers, health insurance information and other treatment information. A health plan notice from Arizona Blue Cross Blue Shield adds that dates of birth and member ID numbers may also have been involved for its members.

Magellan hired the cybersecurity firm Mandiant and reported the attack to law enforcement. It said it added administrative, technical and security safeguards.

Social Security numbers with names and addresses are what criminals need to try to open credit in your name. Insurance and treatment details can be used for medical identity theft, or to make a scam call about a claim sound real.

Sources checked: ocrportal.hhs.gov, securityaffairs.com, azblue.com

Last verified against the official page: 27 Oct 2026

How we research this Report an error

What to do if you were in it

1

Freeze your credit at all three bureaus

A credit freeze is free and stops new accounts being opened with your Social Security number. You place it separately with Equifax, Experian and TransUnion, and you can lift it temporarily when you apply for credit. The FTC explains how at consumer.ftc.gov. A freeze doesn't stop charges on accounts you already have.
2

Check your health insurance statements

Look at explanation-of-benefits statements for services you didn't receive, and tell your insurer about anything unfamiliar.
3

Report identity theft if you see it

If someone has misused your information, report it at IdentityTheft.gov.
4

Change passwords if you're a Magellan employee

Magellan said login-stealing malware was used against some current employees. Change your work password and any other account that shares it, and turn on two-factor authentication.
5

Check whether your email or phone is in this and other breaches

Run a free Serus scan to see which breaches include your email address or phone number.

Official filings

U.S. Department of Health and Human Services , filed 11 May 2020 : 1,013,956 people

Timeline

6 Apr 2020
The breach happened
11 May 2020
The company made it public
11 May 2020
Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the Magellan Health data breach?

If you got a notice letter from Magellan or from your health plan, yes. Several plans and providers that worked with Magellan sent their own notices.

What was exposed?

HHS lists names, addresses, Social Security numbers, health insurance information and other treatment information.

How many people were affected?

Magellan reported approximately 1,013,956 people to HHS.

Should I freeze my credit?

Because Social Security numbers were involved, a free credit freeze at Equifax, Experian and TransUnion is the FTC's recommended step against new-account fraud.