TriZetto Provider Solutions data breach: what happened and what to do

What happened

TriZetto Provider Solutions (TPS) is a billing and claims vendor for healthcare providers. Its customers use a web portal to check things like whether a patient's insurance is active. Notices that providers sent to patients say TPS became aware of suspicious activity in that portal on October 2, 2025. The same notices say the unauthorized access began in November 2024, so the intruder had access for many months before anyone noticed.

According to one provider's notice, the attacker could reach records tied to insurance eligibility verification transactions. TPS has said the incident did not affect payment card, bank account or other financial information. The notices also say TPS was still reviewing which records were affected, so the details for any one person depend on the letter their provider sent them.

The HHS breach portal lists 3,433,965 people affected. The breach was reported through TPS's customers, which is why many people first heard about it from a clinic, a community health center or an ambulance service rather than from TPS itself. TPS worked with the breach notification firm Kroll, which runs a notice site for people who got a letter.

What was exposed

The notices list names, addresses, dates of birth, Social Security numbers, health insurance member numbers, insurer names and dependent information. For some people the member number may include a Medicare Beneficiary Identifier. Which items were exposed varies from person to person.

What that lets criminals do

A name, date of birth and Social Security number together are the core of identity theft. With them, someone can try to open credit, file a fake tax return or apply for a phone contract in your name. Those frauds can start months after a breach, not just in the first week.

Insurance details open a different door. Member numbers and insurer names let a scammer file claims or get care under your coverage, a form of medical identity theft that shows up as strange entries on your explanation of benefits. The same details also make phishing believable: a caller who knows your insurer and your provider's name sounds like the real thing.

TPS says it isn't aware of any identity theft or fraud related to the information involved. That's reassuring, but the data includes things you can't change, like a date of birth and a Social Security number.

The company's response

TPS investigated with outside help and notified providers, who notified patients. Notice letters offer credit monitoring or identity protection, with the terms set in each letter. If you got a letter, enroll before the deadline it gives, and read it for exactly which of your details were involved.

How to protect yourself

Start with the credit freeze, since a Social Security number is involved. Then read every explanation of benefits your insurer sends and ask about any service you don't recognize. Treat unexpected calls, texts and emails that mention your insurance or a recent doctor visit as suspect, and call the number on your insurance card instead of the one in the message.