MedImpact Healthcare Systems, Inc. data breach
MedImpact Healthcare Systems, Inc., a Pharmacy Benefit Manager, reported a data security incident to the Texas Attorney General on September 29, 2026, stemming from a breach on October 18, 2025. This incident potentially exposed sensitive personal and health information. Individuals who received a notification letter may be affected.
Docket sheet
- Company
- MedImpact Healthcare Systems, Inc.
- Venue
- Texas Attorney General
- Filed
- September 29, 2026
- People affected
- Not stated
- Status
- Monitoring
Where this breach stands
- 1
Breach occurredOctober 18, 2025
Date of the incident as stated in the filing.
- 2
Reported to the Texas Attorney GeneralSeptember 29, 2026
The company filed a breach notification with the state regulator.
- 3
Attorney reviewCurrent stage
Current status: Monitoring. Our office is reviewing whether affected people may have claims.
- 4
Your case review
Got a letter about this breach? Submit it for a free, confidential review.
Information listed in the filing
- Full Name
- Date of Birth
- Social Security Number
- Health Insurance ID Number
- Prescription Information
- Diagnosis and Treatment Information
- Provider and Treatment Dates
- Financial Account Number
Clerk's notes
MedImpact Healthcare Systems, Inc., a company operating as a Pharmacy Benefit Manager, formally reported a data security incident to the Texas Attorney General's office. This breach, identified as occurring on October 18, 2025, involved the unauthorized access to sensitive personal information managed by MedImpact, leading to a regulatory filing on September 29, 2026.
The reported data exposure includes categories such as Full Name, Date of Birth, Social Security Number, Health Insurance ID Number, Prescription Information, Diagnosis and Treatment Information, Provider and Treatment Dates, and Financial Account Number. Such information is routinely collected by MedImpact in its role managing prescription drug programs for health plan members.
Breaches involving these specific data types carry significant implications for affected individuals. The compromise of health-related data, combined with personal identifiers, can heighten risks of medical identity theft, fraudulent billing, and broader financial fraud. Individuals receiving an official notification should review it carefully to understand the scope of their exposed information.
MedImpact Healthcare Systems, Inc. is currently under monitoring regarding this incident. Regulatory bodies typically oversee such cases to ensure compliance with data protection statutes and to assess the adequacy of security measures in place at the time of the breach. This incident underscores the ongoing challenge of safeguarding personal information within the healthcare sector.
Receiving a data breach notification indicates that your information was potentially compromised. Understanding your rights and available recourse is important. If you received a data breach letter from MedImpact Healthcare Systems, Inc. concerning the October 18, 2025, incident, you may be eligible to pursue legal action. Our firm is currently reviewing claims related to this data event.
For those affected, initiating a free case review can provide clarity on your specific circumstances and potential next steps. This process allows for an evaluation of how this breach may impact you personally and what options might be available.
If a notification letter about this breach reached you, see every Texas data breach on file or browse all cases.
Other Texas docket entries
- Insight Credit UnionTexas AGNovember 6, 2026Monitoring
- Fisher59, LLCTexas AGNovember 6, 2026Monitoring
- Amplifon (USA), Inc.Texas AGNovember 6, 2026Monitoring
- Park Dental Partners, Inc.Texas AGNovember 6, 2026Monitoring
- UFP Technologies Inc.Texas AGNovember 6, 2026Monitoring
- HTH Companies, Inc.Texas AGNovember 6, 2026Monitoring
- RevSpring, Inc.Texas AGNovember 6, 2026Monitoring
- Gator Town Pediatrics, Family and Urgent Care PLLCTexas AGNovember 6, 2026Monitoring
Attorney advertising. A docket entry reflects a public regulator filing and our review status; it does not mean a lawsuit has been filed. Submitting a review request does not create an attorney-client relationship.