Loading story…
Valley Family Health Care (VFHC), a provider serving communities in Idaho and Oregon, disclosed to the US Department of Health and Human Services that 4,300 patients were affected by the broader TriZetto Provider Solutions (TPS) breach, which began in November 2024. Reporting on the TriZetto incident indicated that healthcare organizations were continuing to notify patients after protected health information was stolen through the vendor, extending the fallout from the third-party compromise into 2026.
VFHC then faced a separate and potentially far larger incident after the threat actor Insomnia listed the organization on its dark web leak site and claimed to have exfiltrated more than one million records. Data later published by the group reportedly included internal documents, patient charts, insurance information, and other highly sensitive PHI; much of the material was described as unencrypted and not password protected, although some files in a "Secure Email" directory were protected. At the time of reporting, VFHC had not publicly disclosed any breach beyond the TPS-related exposure, and the full scope and initial access method for the alleged Insomnia theft had not been confirmed.
See the actors and campaigns active against you right now.
8 events from the most recent confirmed update back to the earliest known activity.
The Oncology Institute disclosed that patient information was affected in a cybersecurity incident involving a third-party software provider. The company said it was notified on 2026-05-20 that unauthorized access at the vendor affected its patient data, and indicated other healthcare providers may also be impacted.
DataBreaches published findings on an apparent second VFHC breach, noting it could not confirm the full scale of the alleged theft or how Insomnia gained access. VFHC had not responded to inquiries by publication time and had not publicly disclosed any breach beyond the TriZetto incident.
After listing VFHC, Insomnia later released a tranche of alleged stolen data. Reported contents included internal documents, patient charts, insurance information, and other protected health information, much of it apparently unencrypted.
A Fox News report said the cyberattack affecting TriZetto Provider Solutions exposed 3.4 million patient records, indicating the incident was far broader than the previously documented impact on Valley Family Health Care alone. The report represents a new public accounting of the overall scale of the TriZetto-related breach.
On March 7, 2026, the threat actor Insomnia added Valley Family Health Care to its dark web leak site and claimed to have exfiltrated more than one million records containing sensitive patient information. The claim represented a separate incident from the TriZetto breach.
On 2026-02-06, the Office of the Vermont Attorney General published a consumer breach notice concerning the TriZetto Provider Solutions incident. The notice marked a separate official notification step following Valley Family Health Care's earlier HHS disclosure of patient impact.
On January 12, 2026, Valley Family Health Care disclosed to the U.S. Department of Health and Human Services that 4,300 patients were affected by the TriZetto Provider Solutions breach. This was the only VFHC breach publicly disclosed at that time.
Valley Family Health Care said the TriZetto Provider Solutions incident affecting its patients began in November 2024. The breach ultimately impacted 4,300 VFHC patients.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcedatabreaches.net
Open sourcefoxnews.com
Open sourceago.vermont.gov
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple healthcare-sector data breaches were disclosed with significant exposure of **protected health information (PHI)**. TriZetto Provider Solutions (TPS), an insurance verification provider, reported a compromise that began in **November 2024** and was not detected until nearly a year later; the threat was reportedly eradicated on **Oct. 2, 2025**. Notifications to affected healthcare provider customers across several states continued into late 2025 and early 2026, with one Oregon advisory estimating exposure affecting **more than 700,000 people**; impacted providers stated there was no current evidence of misuse and that **financial details were not stolen**. Separately, Healthcare Interactive (*HCIactive*), an AI-powered insurance enrollment and benefits administration vendor, confirmed that an intrusion and data exfiltration tied to activity in mid-2025 ultimately affected **3,056,950 individuals**, after earlier placeholder reporting while scope was still being determined; reported unauthorized access windows vary from **July 8–12, 2025** to a broader **June 17–July 22, 2025**. Another incident involved AI care-coordination platform *Lena Health*, where a threat actor claimed exposure of patient data (including references to a **Twilio call recording database**) and alleged that **2,134 patients’ PHI** was stored in an unencrypted export in a public-facing **AWS S3 bucket**, with follow-on reporting indicating exploitation after a publicly disclosed vulnerability and an available patch that was not applied in time.
Jun 29, 2026
**TriZetto Provider Solutions** (a Cognizant business unit providing revenue cycle management and claims clearinghouse services) is notifying more than **3.4 million individuals** after investigators determined threat actors accessed and exfiltrated healthcare clients’ **insurance-related data**. The activity reportedly began in **November 2024** but was not detected until **October 2025**, indicating a prolonged period of unauthorized access before discovery. The incident was reported to the U.S. Department of Health and Human Services via the **HIPAA Breach Reporting Tool** as impacting approximately **3.43 million** people, while TriZetto has not publicly specified how many healthcare customers were affected. Multiple healthcare organizations have publicly stated they were impacted and have issued their own patient notifications, underscoring downstream exposure risk for providers relying on TriZetto’s billing and claims processing services.
Jun 29, 2026
Health insurance technology provider **TriZetto Provider Solutions** (a Cognizant subsidiary) updated breach notifications indicating the impact of its **November 2024** intrusion has grown to **more than 3.4 million** affected individuals. Disclosures to state regulators and downstream notifications from county governments and healthcare providers indicate theft of sensitive personal data including **addresses, Social Security numbers, and health insurance identifiers**, with some jurisdictions reporting hundreds of thousands of impacted residents. Separately, the **Conduent** incident has expanded dramatically in public filings, with reported totals rising from roughly **10.5 million** to **more than 25 million** affected individuals across the US, including a major increase in **Texas** (reported at **15.4 million**) while **Oregon** remains around **10.5 million**. Reporting indicates attackers maintained access for roughly **three months** and exfiltrated about **8 TB** of data, underscoring the systemic risk posed by large, behind-the-scenes vendors that support **Medicaid/SNAP and other state benefit programs**, healthcare-related processing, and major employer services—creating a wide “blast radius” even for individuals unfamiliar with the vendor name.
Jun 29, 2026