MedImpact Healthcare Systems, Inc. data breach
MedImpact Healthcare Systems, Inc. notified the California Attorney General of a data breach that occurred in October 2025, exposing sensitive personal and health information. This incident could leave affected individuals vulnerable to medical identity theft and other forms of fraud. Understanding your rights and potential next steps is crucial if you received a notification.
Docket sheet
- Company
- MedImpact Healthcare Systems, Inc.
- Venue
- California Attorney General
- Filed
- September 25, 2026
- People affected
- Not stated
- Status
- Monitoring
Where this breach stands
- 1
Breach occurredOctober 18, 2025
Date of the incident as stated in the filing.
- 2
Reported to the California Attorney GeneralSeptember 25, 2026
The company filed a breach notification with the state regulator.
- 3
Attorney reviewCurrent stage
Current status: Monitoring. Our office is reviewing whether affected people may have claims.
- 4
Your case review
Got a letter about this breach? Submit it for a free, confidential review.
Information listed in the filing
- Full Name
- Date of Birth
- Social Security Number
- Health Insurance ID Number
- Prescription Information
- Medical Claims History
- Provider and Treatment Dates
- Home Address
Clerk's notes
MedImpact Healthcare Systems, Inc., a key player in managing prescription drug programs, reported a significant data security incident to the California Attorney General on September 25, 2026. The breach, which was identified as occurring on October 18, 2025, is currently under monitoring, indicating an ongoing review of its full scope and impact.
The compromised data categories reported in this incident include individuals' Full Name, Date of Birth, Social Security Number, Health Insurance ID Number, Prescription Information, Medical Claims History, Provider and Treatment Dates, and Home Address. Such highly personal health and identifying data, unlike financial account numbers, cannot be easily changed or cancelled, posing long-term risks such as medical identity theft, targeted phishing schemes, and various forms of fraud.
As a company handling vast amounts of protected health information, MedImpact Healthcare Systems, Inc. is bound by strict federal and state regulations, including the Health Insurance Portability and Accountability Act (HIPAA), the California Confidentiality of Medical Information Act (CMIA), and the California Consumer Privacy Act (CCPA). A breach of this nature suggests potential failures in safeguarding sensitive data, which could indicate a breach of statutory duties of care.
If you have received an official data breach notification letter from MedImpact Healthcare Systems, Inc., it formally acknowledges that your private information has been exposed. This notification is an important legal step, as it establishes your standing to seek legal recourse. You do not need to wait for actual financial or medical identity theft to occur; the increased risk and loss of privacy are actionable injuries under the law. We are currently evaluating cases related to this breach to help affected individuals understand their options.
If a notification letter about this breach reached you, see every California data breach on file or browse all cases.
Other California docket entries
- ZZ Diag ProbeCalifornia AG—Monitoring
- STS Aviation GroupCalifornia AGOctober 19, 2026Monitoring
- Citizens BankCalifornia AGOctober 19, 2026Monitoring
- John G. Yphantides, a Professional Law CorporationCA AGOctober 16, 2026Monitoring
- Neuro Wellness SpaCalifornia AGOctober 16, 2026Monitoring
- Frazer LLPCalifornia AGOctober 16, 2026Monitoring
- Covered CaliforniaCalifornia AGOctober 16, 2026Monitoring
- Inner City Education FoundationCA AGOctober 16, 2026Monitoring
Attorney advertising. A docket entry reflects a public regulator filing and our review status; it does not mean a lawsuit has been filed. Submitting a review request does not create an attorney-client relationship.