UnknownHealthcareFinancial ServicesHealthcareCustomer Data InvolvedPIIPHIIdentity (basic)LowContained

MedImpact Healthcare

bd_d1d5a4ce84c29d9b · schema v1 · pii pii-v2

Severity

Low

Discovered

Oct 18, 2025

Filed

Sep 1, 2026

To disclose

—

Affected

211state residents only

Linked

6 records

Confidence

66%

Full breach record for MedImpact Healthcare →

MedImpact Healthcare Systems, Inc., a pharmacy benefits manager, identified unauthorized activity in its systems on October 18, 2025. The company secured affected systems and engaged cybersecurity experts. Certain data relating to individuals was potentially impacted. MedImpact is offering identity monitoring services through Kroll.

J jump to incidentP pin to compareR raw source

Incident timeline

Oct 18, 2025

Discovered

Sep 1, 2026

Filed

This filing is one of 6 records about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Siteqilinbd_b1db918e771e4fe92025-10-12 · +324dVerified

Regulatory filings (4) · sorted by filing gap

California State AGbd_935b807df52a877a2026-09-15 · +14dVerified
California State AGbd_14e2f6ba42db654b2026-09-25 · +24dVerified
Oregon State AGbd_3392b05e9b0f70902026-09-26 · +25dVerified
Texas State AGbd_051c407f829eb5812026-09-29 · +28dVerified

Name: MedImpact Healthcare
norm: medimpact healthcare
Domain: medimpact.com

Name: MedImpact Healthcare
norm: medimpact healthcare
Domain: medimpact.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Oct 18, 2025
Materiality determined: —
Notification sent: —
Affected individuals: 211state-resident count only
Data types: PIIPHIIdentity (basic)
Attack vector: Unknown

During the incident: Took steps to secure the affected systems
Engaged cybersecurity experts to assist in the investigation and response
Conducted a detailed review of data potentially impacted by the incident
Secured the services of Kroll to provide identity monitoring at no cost
Changes made: Taken steps to further enhance its security safeguards and monitoring
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Massachusetts State AGSep 1 · first · this page

California State AG+14d

California State AG+24d

Oregon State AG+25d

Texas State AG+28d

Pattern: first filing Sep 1 (MA), last Sep 29 (TX) — a 28-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-1645-medimpact-healthcare-systems-inc/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 1, 2026
Raw hash: 3433efd2d2b20461022a608652c05ab917d06dc9f2d49a729ba27cd12c0a5697

Linked disclosures

Ransomware claims (1)

Regulatory filings (4) · sorted by filing gap

Reporting entityMedImpact Healthcare

Victim entityMedImpact Healthcare

Incidentdiscovered Oct 18, 2025

Stated responseTook steps to secure the affected systems

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov