TriZetto: Eleven Months of Undetected Access in a Healthcare Claims Clearinghouse

TriZetto Provider Solutions, the Cognizant-owned revenue-cycle and claims-clearinghouse vendor that sits underneath a large slice of US physician billing, has confirmed a data breach affecting more than 3.4 million people. The figure cited most consistently across reporting is 3,433,965 individuals, a precise count that several outlets trace to breach notices filed with state attorneys general, including Oregon, and to the incident's listing on the HHS Office for Civil Rights breach portal. The defining detail is not the volume but the dwell time: TriZetto detected suspicious activity on a customer-facing web portal on October 2, 2025, and the subsequent forensic investigation placed the start of unauthorized access in November 2024, roughly eleven months earlier. Exposed data reportedly includes Social Security numbers, health insurance details, and medical information tied to insurance eligibility verification transactions.

One caveat up front, and it matters for how much weight you put on the specifics below. Every source available for this brief is secondary or commercial in nature. We have no direct copy of TriZetto's own notification letter, no regulator filing text, and no vendor advisory. The core facts are consistent across all five accounts, which is reassuring, but the granular details are reported rather than confirmed from the source documents.

What Happened

The timeline that emerges from the reporting is coherent across sources, with one account providing more precision than the rest.

On October 2, 2025, TriZetto Provider Solutions identified suspicious activity within a web portal that its healthcare provider customers use to reach the TriZetto platform. The company says it moved to secure the portal and opened an investigation with outside cybersecurity assistance.

That investigation reportedly found the intrusion was far older than the alert. Most sources date initial unauthorized access to November 2024. One account is more specific, giving November 19, 2024 as the start date. Either way, the window between initial access and detection is approximately eleven months.

Subsequent milestones, reported in the most detailed of the available accounts and broadly consistent with the others:

• November 28, 2025: TriZetto confirmed that private information had in fact been accessed and exfiltrated, not merely exposed.
• December 9, 2025: Notification to affected healthcare provider customers began. Because TriZetto is a HIPAA business associate rather than a covered entity, some of those providers then issued their own notices directly to patients, which is part of why patient-level awareness lagged so far behind discovery.
• February 6, 2026: The incident was reported to the US Department of Health and Human Services.
• Early to mid 2026: Breach notifications surfaced with state regulators, with reporting citing filings in Maine (March 2026) and Oregon, and the incident appearing on the HHS OCR breach portal.

Measured end to end, roughly sixteen months elapsed between the intruder's first access and the incident reaching the federal breach portal. That is the number defenders should sit with.

What Was Taken

The data categories reported across sources center on insurance eligibility verification records, the routine coverage checks a provider runs before delivering care. That transaction type is unglamorous but identity-dense: it typically pairs a patient identifier with an insurer, a member ID, and enough demographic data to match the two.

Reported exposed data includes:

• Social Security numbers
• Health insurance information, including plan and member details
• Medical and health-related information
• Personal identifiers tied to eligibility verification transactions

On the numbers, accounts differ and the difference should be stated rather than smoothed over. The dominant figure, appearing in four of five sources, is more than 3.4 million individuals, with the exact count of 3,433,965 attributed to state attorney general filings and the HHS OCR portal. However, one source reproduces a February 18, 2026 PR Newswire announcement from the law firm Schubert Jonckheer & Kolbe describing an investigation into unauthorized access affecting "more than 700,000" individuals. That excerpt is truncated in the source and it is not clear whether it refers to this incident, to an earlier partial count, or to a differently scoped subset such as a single provider client's patient population. Treat 3.4 million as the operative figure and treat the 700,000 reference as unresolved rather than contradictory.

Scale claims about TriZetto's footprint also come from a single source and should be attributed, not asserted. One outlet states TriZetto processes insurance eligibility for 875,000 healthcare providers and serves 200 million people. No other available source corroborates those figures. They are plausible for a clearinghouse of this type, but they are one outlet's numbers.

No source names a threat actor. No ransomware group claim, no extortion demand, and no malware family appears anywhere in the reporting. Eleven months of quiet reading, followed by no public claim, is more consistent with data-theft-for-resale or an espionage-adjacent collection posture than with a smash-and-grab extortion crew.

Why It Matters

TriZetto is not a hospital. Almost nobody in the 3.4 million had a relationship with it, or had heard of it. Their records passed through because their doctor's office used it for billing. That is the entire threat model of this incident in one sentence.

Clearinghouses concentrate risk that no individual provider can see. A single mid-sized physician practice holds thousands of patient records. The clearinghouse it routes claims through holds millions, aggregated across unrelated practices with no shared security posture, no shared incident response, and no visibility into each other. Compromising one portal at one vendor yields what would otherwise require compromising hundreds of independent targets.

Eleven months is not a detection failure at the edge, it is a detection failure at the core. The intruder was not caught by an EDR alert or a threat hunt. It was caught by suspicious activity in a portal, roughly a year in. Whatever telemetry existed on the eligibility-transaction data path did not fire on sustained anomalous record access. For any organization operating a high-volume query interface over sensitive records, this is the lesson: perimeter authentication logging is not access monitoring.

The notification chain adds months of exposure. Because a business associate notifies its covered-entity customers, who then notify patients, the people whose SSNs were taken learned of it long after the attackers had them. Business associate agreements that do not specify aggressive notification timelines are quietly transferring risk onto patients.

The legal tail is already forming. One source, a commercially operated legal-intake site with an obvious financial interest in the litigation, reports that twelve lawsuits have been consolidated into a single federal multidistrict case designated MDL 3185, and states clearly that there is no settlement and no claim form at this stage. That consolidation claim is uncorroborated by the other sources and is presented here as that site reports it. Another source independently describes a "sprawling federal lawsuit" moving through federal court, which is consistent in direction if not in detail.

The Attack Technique

Here the reporting thins considerably, and honesty is more useful than reconstruction.

What is reported consistently: the compromise involved a web portal used by TriZetto's healthcare provider customers to access the TriZetto platform. That portal is where the October 2, 2025 suspicious activity was detected, and it is described across sources as the locus of the incident.

What is reported about attacker behavior: the unauthorized party was reading records tied to insurance eligibility verification transactions, according to the litigation complaints as summarized in one source. That phrasing suggests query-level access to eligibility data rather than bulk database exfiltration or destructive action, though the distinction is inferred from secondary description, not confirmed.

What is not reported anywhere: the initial access vector. No source identifies whether the entry point was credential stuffing or stolen provider credentials, an unpatched vulnerability in the portal application, a web shell, session hijacking, or abuse of legitimate customer access. No CVE is cited. No indicators of compromise have been published. No named actor or group is attributed.

The one structural inference worth drawing: a provider-facing portal is a trusted-tenant interface. It is designed to let many external organizations query patient data as a matter of normal business. An attacker operating inside that design, using access that looks like a customer doing customer things, generates traffic that is extremely difficult to distinguish from legitimate load. Eleven months of undetected access through such an interface is unsurprising in the absence of per-tenant behavioral baselining.

What Organizations Should Do

1. Inventory your clearinghouses and business associates, then rank them by record concentration. Your third-party risk register probably sorts vendors by contract value. Re-sort it by how many of your patients' records the vendor can reach. The billing intermediary nobody thinks about will frequently sit at the top.

2. Baseline and alert on per-tenant query volume in any customer-facing data portal. If you run a multi-tenant interface over sensitive records, detection cannot rest on authentication events. Build behavioral baselines per customer account for query rate, record volume, access hours, and source geography, and alert on sustained deviation. Eleven months of anomalous reads should be detectable in week one.

3. Treat eligibility and verification data as PII of the highest sensitivity. Eligibility records are routinely classified as low-value operational metadata. They are not. They marry identity to insurance to SSN. Apply the same retention limits, field-level encryption, and access logging you apply to clinical records, and aggressively purge completed verification transactions.

4. Rewrite business associate agreements to compress the notification chain. Require notification to you within a defined short window of the business associate confirming unauthorized access, not of the business associate completing its investigation. In this incident the gap between detection and customer notification was over two months, and between detection and HHS reporting, over four.

5. Rotate and constrain outbound credentials to third-party portals. If your practice or health system authenticates into a vendor portal, those credentials are an attack surface you own. Enforce phishing-resistant MFA, scope accounts to the minimum record set, expire dormant accounts, and review access logs on your side rather than relying on the vendor to notice.

6. Run a dwell-time tabletop against your highest-concentration vendor. The scenario is not "the vendor gets ransomwared and we find out Tuesday." It is "the vendor was read for a year, told us in month fourteen, and our patients are asking us questions we cannot answer." Decide now who notifies patients, on what timeline, and who pays for credit monitoring.

Sourcing Note

This brief is assembled from five secondary sources. None is a primary document: no TriZetto notification letter, no HHS OCR portal entry text, no state attorney general filing, and no national CERT advisory was available. The consistent facts across all five are the victim, the Cognizant ownership, the October 2, 2025 detection date, the November 2024 access start, the approximately eleven-month dwell time, the 3.4 million figure, and the presence of SSNs and health insurance data.

The single-source claims flagged above, specifically the 875,000 provider and 200 million people scale figures, the 700,000 individual reference, the November 19, 2024 precise start date, and the MDL 3185 consolidation, should be verified against the underlying filings before being relied upon operationally. One of the five sources is a legal lead-generation site with a direct commercial interest in the litigation and should be weighted accordingly.

Sources: TriZetto Data Breach Exposes 3.4 Million Patient Health Records | Trizetto Provider Solutions Data Breach – Mosquera | Trizetto Confirms Data Breach Impacting 3 4 Million Healthcare Reco... | Cognizant Data Breach: What Happened, Who Is Affected, and What Com... | TriZetto / Cognizant Data Breach: 3.4M Patients, MDL 3185