TriZetto Provider Solutions , a leading provider of technology solutions for the healthcare industry , has suffered a major data breach that affected more than 3.4 million people . The company develops software and services used by health insurers and healthcare providers to manage critical processes , making the incident particularly serious for the digital health ecosystem.
When was the suspicious activity detected
TriZetto , which has been under the Cognizant umbrella since 2014, revealed that it detected suspicious activity on a web portal on October 2 , 2025, and immediately launched an internal investigation with the assistance of external cybersecurity experts. Analysis of the systems showed that the unauthorized access had begun much earlier, specifically on November 19, 2024, meaning the attackers remained invisible for almost a year.
See also: InstallFix: Infostealer distribution via fake installation guides by Claude Code
Cognizant TriZetto: What data was exposed
According to the research findings, the attackers gained access to records related to insurance eligibility verification transactions, a process used by healthcare providers to confirm a patient’s insurance coverage before providing treatment. The data exposed varies from person to person and may include name, address, date of birth, social security number, health insurance details, and provider or insurer information.
How many were affected and when were they notified
Affected providers were initially notified on December 9, 2025, while the public notification process began several months later, in early February 2026. According to an official filing with the Maine Attorney General, the total number of people affected is 3,433,965, making the incident one of the largest health data breaches in recent years.
What was not leaked according to the company
TriZetto says no credit card details, bank accounts or other direct financial information were exposed in the incident. It also says it has not yet seen any instances of data being misused by cybercriminals. However , cybersecurity experts point out that even demographic or insurance data can be used in identity theft or targeted fraud.
See also: FBI investigation into breach of surveillance systems
The mitigation measures and the investigation
The company says that after discovering the breach, it has strengthened its cybersecurity mechanisms, notified the relevant law enforcement authorities and is working with independent experts to fully investigate the incident. It is also offering affected users a free 12-month credit profile monitoring and identity protection service through Kroll.
Questions about the delay in notification
Despite the measures announced, questions remain regarding why consumer notification was delayed for several months after the suspicious activity was identified. Journalistic sources report that clarifications were requested from the company without an official response being given up to the time of publication.
The broader context of cyber attacks
In recent years, the digital health sector has become an increasingly attractive target for cybercriminal groups, as health databases contain valuable personal information. Unlike credit card numbers that can be canceled relatively quickly, medical and insurance data remains useful for a long time, allowing for sophisticated identity fraud and targeted social engineering attacks.
See also: MuddyWater invades US networks with new backdoor
Parent company Cognizant has been at the center of security incidents in the past, as in 2020 it was linked to a ransomware attributed to the Maze, while in 2025 Clorox filed a lawsuit accusing it of gross negligence after a social engineering incident that allegedly allowed members of the group Scattered Spider to gain access to corporate systems. These incidents show that the security of the software and IT services supply chain is becoming a critical issue for the entire digital health and insurance services ecosystem worldwide. As organizations invest in cloud platforms and interconnected systems, the need for stronger cyber defenses, transparency, and faster user notification becomes imperative.
Source: www.bleepingcomputer.com
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
