Quantum Health data breach: what happened and what to do

Quantum Health is a healthcare navigation company based in Dublin, Ohio. It helps employees and health plan members find care and handle claims, so its systems hold the kind of detail that insurers and employers hold. In mid 2026 it disclosed a cyberattack that started with a phone call.

What happened

On May 29, 2026, an attacker phoned a Quantum Health user and tricked them into giving access to the company's network. This is voice phishing: the caller pretends to be someone who needs a login, and the person on the line does the rest. The intruder had access between May 29 and June 1, 2026 and took files during that time. A network disruption was also reported on June 1.

Quantum Health investigated which files were taken and who was in them. On June 8, 2026 it confirmed that the stolen data included personal and health information. It then began notifying affected people and listed the incident with the U.S. Department of Health and Human Services (HHS) as a cyberattack.

What was exposed

The data varies by person. According to the reporting on the incident, the stolen files included Social Security numbers, diagnosis and treatment details, prescriptions, and insurance and claims information, along with names. Not everyone had every item, so the letter you receive is the authoritative list for you.

What that lets criminals do

Claims and prescription data is personal. A scammer who knows your plan, a treatment and your name can write a message that sounds like your insurer or pharmacy. Expect fake billing notices, offers to "review your claim" and calls asking you to confirm a Social Security number.

A Social Security number paired with a name is the starting point for identity theft: new credit accounts, tax refund fraud and benefit claims. Insurance and claims details can also be used for medical identity theft, where someone else gets care billed to your plan.

Quantum Health's response

Quantum Health is offering free credit monitoring and identity theft protection to affected people. No attacker was named in the sources, and no ransomware group claimed the breach.

Who is affected

Quantum Health works through employers and health plans, so you may not have dealt with the company directly. If you are a member of a plan that uses its services, watch your mail for a notice. It may arrive from Quantum Health or from your employer or plan.

Why health data is hard to take back

You can change a password in a minute. You can't change a diagnosis or a prescription history, and a Social Security number stays yours for life. That is why the steps below focus on limiting what others can do with the data: a credit freeze blocks new accounts, and checking your claims statements catches misuse of your coverage early.

Serus can't remove data from a breach. What it does is watch breach databases and the dark web for your email, phone and other details and alert you, so you hear about new exposures early instead of from a collections notice.