Cognizant’s TriZetto breach grows to 3.4 million people, exposing sensitive health and insurance data

TriZetto Provider Solutions, a Cognizant-owned healthcare technology company, has disclosed that a cyberattack exposed the personal and health-related information of 3,433,965 people. The incident ranks among the largest healthcare data breaches confirmed so far in 2026, and it shows how third-party vendors remain a major weak point in the healthcare supply chain.

Public reports and breach notices say TriZetto detected suspicious activity in a web portal on October 2, 2025. Investigators later determined that unauthorized access had begun on November 19, 2024, which means the breach window stretched for nearly a year before the company identified it.

The exposed information did not come from a direct hack of hospitals or clinics themselves. Instead, attackers accessed data stored in TriZetto’s environment, which many healthcare providers use for insurance eligibility and related administrative transactions. That matters because a single breach at a business associate can ripple across many provider organizations and affect patients who may never have heard of the vendor.

What happened

TriZetto said it found suspicious activity in a customer-facing web portal used by some healthcare providers. The company secured the portal, brought in outside incident response help, and later determined that an unauthorized actor had accessed historical eligibility-related records.

Recent reporting says the final affected count rose far above earlier estimates. TriZetto initially surfaced in notices involving hundreds of thousands of people, but updated filings now put the total at 3,433,965 affected individuals.

What data was exposed

The compromised data appears to include a mix of personally identifiable information and protected health or insurance information. Notices and reporting indicate that the exposed fields may include names, addresses, dates of birth, Social Security numbers, health insurance member numbers, Medicare beneficiary numbers, insurer names, and other demographic and coverage-related information.

That combination raises the risk beyond ordinary spam. Attackers can use health insurance and identity data for phishing, account fraud, false claims activity, and medical identity theft. While public reporting has not established that the stolen data has already been misused at scale, the kind of information involved can support targeted scams for years.

Timeline at a glance

Why this breach matters

Healthcare already struggles with concentration risk. A relatively small number of clearinghouses, billing vendors, and revenue-cycle platforms sit between providers, insurers, and patients. When one of those companies gets hit, the blast radius spreads quickly across multiple states and organizations.

This case also raises hard questions about detection. Based on the dates now reported, the intrusion started in November 2024 and was not spotted until October 2025. That kind of dwell time gives attackers ample opportunity to move through exposed data stores and extract records quietly.

What affected people should watch for

People who receive a TriZetto-related notice should read it carefully and check whether it names the healthcare provider tied to their records. They should also watch for insurance statements, Explanation of Benefits notices, and unfamiliar billing activity, since health-data breaches often create confusion long before obvious financial fraud appears.

More immediate defensive steps include:

• place a fraud alert or credit freeze with the major credit bureaus
• monitor mail and email for healthcare-themed phishing attempts
• review health insurance claims and provider statements
• use any credit monitoring or identity protection services offered in the breach notice

These steps cannot undo the exposure, but they can reduce the chance that criminals turn leaked data into secondary fraud. General breach-response guidance consistently recommends fast monitoring when Social Security and insurance identifiers are involved.

FAQ