Published:

2025-12-12

Updated:

2026-11-03

TriZetto Provider Solutions Reports Data Breach Impacting Healthcare Clients

A timeline of the TriZetto Provider Solutions breach, the data exposed, counts by state, the vendor chain behind it, HIPAA notification timing, and the steps third-party risk teams can take now. Every figure carries a numbered source.

What was the TriZetto Provider Solutions data breach, and how many people did it reach?

TriZetto Provider Solutions, a Cognizant-owned revenue management company and claims clearinghouse, disclosed a breach in which an unauthorized party reached historical insurance eligibility transaction reports. The exposure touched more than 3.4 million people, and most of them never dealt with TriZetto directly. They were patients of health centers and other providers that route claims and eligibility checks through the clearinghouse, so one vendor held records for many separate organizations. The numbers come from filings with state attorneys general, and each filing reports a different figure, which makes the headline count easy to misread. “The 3.4 million figure is the best single estimate until TriZetto or HHS publishes a final count.” HIPAA Journal adds that the true total could be higher. For a provider organization, the useful question is not the national total but whether its own patients appear in the eligibility reports that TriZetto handled.

When did the TriZetto breach start, when was it found, and has the cause been disclosed?

An unauthorized party first accessed TriZetto systems in November 2024, and TriZetto found suspicious activity in a provider web portal on October 2, 2025, about eleven months later. That gap is the central fact of the incident, because for most of a year the files could be reached without TriZetto or its provider clients knowing. Cognizant, the parent company, did not explain the intrusion or why detection took about a year. “How the attackers got in has not been made public.” Until the cause is disclosed, every provider that sends claims or eligibility checks through TriZetto has to treat the detection gap as an open question. A security questionnaire completed before the access began would not have shown the problem, which is why the timing matters for how organizations monitor vendors between assessments.

What kind of information did the TriZetto breach expose, and was financial data involved?

The stolen files were historical insurance eligibility transaction reports, which record who is covered by which plan and who treated them. Inside these reports, identity details sit beside health insurance details, including Social Security numbers, and that pairing is what makes the data useful for identity fraud and insurance fraud. TriZetto says no financial information was involved, so bank and card details were outside the files. The exposed records are personal and cannot be reissued the way a payment card can, which is why affected people received notice letters along with an offer of credit protection services. Providers that field questions from patients can anchor their answers on two points: the files held identity and coverage data, and TriZetto reports that no financial data was included. Keep that framing consistent across every department that answers calls.

Why did one TriZetto breach reach so many provider organizations?

TriZetto sits between provider organizations and health plans, so a single compromised portal produced records for dozens of separate organizations. A health center that sends claims or eligibility checks through a clearinghouse has a business associate relationship with it, and some health centers reach TriZetto only through another vendor. OCHIN, a nonprofit that provides health technology to about 300 rural and community care providers, confirmed that its patients were affected. In that arrangement the health center holds the patient relationship, OCHIN is its vendor, and TriZetto is the vendor behind the vendor, a fourth party the health center never contracted with directly. A vendor inventory that stops at direct contracts would not have shown this exposure. That structure also explains why many organizations learned of the problem through TriZetto’s notice to provider clients rather than through their own monitoring.

What does HIPAA require after a vendor breach, and does the provider still have to notify patients?

Yes, the provider still owes notice to patients. “The covered entity remains responsible for notifying individuals even when the breach happened at a vendor, although it can delegate the mailing by contract.” Under the HIPAA Breach Notification Rule, the vendor tells the covered entity first, and the covered entity then notifies affected individuals, HHS, and in larger cases the media, each within a 60-day outer limit counted from discovery. “That is why a vendor notice starts a clock on the provider side.” The practical consequence is that a provider cannot treat a TriZetto letter as TriZetto’s problem alone. Someone inside the organization has to record the date the notice arrived, decide whether the breach involved the provider’s patients, and decide which notices apply. Delegation to the vendor changes who mails the letters, not who is accountable for the deadline.

What should a healthcare organization do first after the TriZetto breach, and have lawsuits been filed?

The first step is to search your vendor inventory for TriZetto and for every vendor that routes claims or eligibility checks through it, including OCHIN, so you know whether the exposure reaches your patients through a direct path or a fourth-party path. The second step is to compare the date your vendor notice arrived with the 60-day limit and record who decided which notices apply. After those two steps, review incident reporting terms in vendor contracts and ask the vendor for cause and containment evidence. Lawsuits have been filed against Cognizant and TriZetto, and they were consolidated into one multidistrict case in federal court in 2026, but no settlement has been announced. Litigation does not replace any notice or review a provider owes on its own, so treat the case as background and run the vendor response on a separate track.

TriZetto Provider Solutions, a Cognizant-owned revenue management company and claims clearinghouse, disclosed a breach that reached more than 3.4 million people through the provider organizations it serves. An unauthorized party first accessed TriZetto systems in November 2024, and TriZetto found suspicious activity in a provider web portal on October 2, 2025, about eleven months later. The stolen files were historical insurance eligibility transaction reports.

This post sets out the timeline, the data involved, the number of people affected by jurisdiction, why a single clearinghouse breach reached so many providers, what HIPAA requires after a vendor breach, where the multidistrict litigation stands, and what third-party risk teams should do now. Every figure is tied to a numbered source, and details TriZetto has not disclosed are marked as undisclosed.

What happened

TriZetto engaged the cybersecurity firm Mandiant after it identified suspicious activity within its web portal on October 2, 2025^[1]. From October 2 through the end of November, TriZetto reviewed the compromised files, and on November 28, 2025 it learned that the affected data included protected health information (PHI)^[1]. It began notifying provider clients on December 9, 2025, and notification letters reached individuals starting in January 2026^[1]. TriZetto says it removed the threat actor and has detected no further unauthorized portal activity since October 2, 2025^[1].

How the attackers got in has not been made public. Cognizant said it eliminated the threat but did not explain the intrusion or why detection took about a year^[2].

TriZetto breach timeline, November 2024 to June 2026
Date	Event	Source
November 2024	An unauthorized party first accesses historical eligibility transaction reports	[1][2]
October 2, 2025	TriZetto identifies suspicious activity within a provider web portal	[1][2]
October 2 to late November 2025	TriZetto reviews the compromised files with Mandiant	[1]
November 28, 2025	TriZetto learns the affected data includes PHI	[1]
December 9, 2025	TriZetto begins notifying provider clients	[1]
January 2026	Notification letters reach individuals	[1]
March 6, 2026	A Maine Attorney General filing puts the total above 3.4 million people	[2]
June 5, 2026	The Judicial Panel on Multidistrict Litigation consolidates 19 actions as MDL No. 3185	[3]

‍

What data was involved

The files held names, addresses, dates of birth, and Social Security numbers, along with health insurance member numbers and, in some cases, Medicare beneficiary numbers^[1]. They also held provider names, health insurer names, primary insured information, and other demographic, health, and insurance details^[1]. TriZetto says no financial information was involved^[1]. It offered affected individuals complimentary credit monitoring, fraud consultation, and identity theft restoration services^[1].

Eligibility transaction reports record who is covered by which plan and who treated them. That combination of identity data and coverage data is what makes the files useful for identity fraud and insurance fraud.

How many people were affected

TriZetto reported 3,433,965 individuals in its Oregon filing, plus 304 more tied to Columbia River Health as a business associate^[1]. A Maine Attorney General filing reported on March 6, 2026 put the total above 3.4 million^[2]. HIPAA Journal lists 46 affected entities, most of them health centers connected to TriZetto through OCHIN or as direct business associates, and notes that the true total could be higher^[1].

Reported counts by jurisdiction
Jurisdiction or measure	Reported figure	Source
Oregon filing	3,433,965 individuals, plus 304 tied to Columbia River Health	[1]
Maine filing (March 6, 2026)	More than 3.4 million people	[2]
Texas	171,158 residents	[1]
South Carolina	3,562 individuals	[1]
California, Massachusetts, New Hampshire, Vermont	Notified, counts not published	[1]
Entities listed by HIPAA Journal	46	[1]

‍

The state counts overlap, because each filing reports its own residents or the full total, so the rows should not be added together. The 3.4 million figure is the best single estimate until TriZetto or HHS publishes a final count.

Why a clearinghouse breach reaches so many providers

TriZetto sits between provider organizations and health plans. A health center that sends claims or eligibility checks through a clearinghouse has a business associate relationship with that clearinghouse, and some health centers reach TriZetto only through another vendor. OCHIN, a nonprofit that provides health technology to about 300 rural and community care providers, confirmed that its patients were affected^[2]. In that arrangement the health center is the covered entity, OCHIN is the business associate, and TriZetto is the subcontractor, which is a fourth party from the health center's point of view.

That chain explains the shape of the breach. A single compromised portal produced records for dozens of separate organizations, and many of them learned of the exposure through TriZetto's notice to provider clients. HIPAA Journal counted 118 of the 741 breaches of 500 or more records reported to the Office for Civil Rights (OCR) in 2024 as filed by business associates^[7], and a Ponemon Institute report sponsored by Censinet found that 46% of ransomware attacks reported by respondents were caused by a third party, up from 36% in 2021^[6].

What HIPAA requires after a vendor breach

The HIPAA Breach Notification Rule puts timed duties on each party in the chain^[4]. A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovering a breach. The covered entity then notifies affected individuals within the same 60-day limit, and notifies HHS and, for breaches affecting more than 500 residents of a state, the media.

Breach Notification Rule timing by party
Party	Notifies	Deadline under the Breach Notification Rule
Business associate or subcontractor	The covered entity or business associate above it	Without unreasonable delay, no later than 60 days after discovery
Covered entity	Affected individuals	Without unreasonable delay, no later than 60 days after discovery
Covered entity	HHS for breaches of 500 or more people	At the same time as individual notice
Covered entity	Prominent media outlets for more than 500 residents of one state	Without unreasonable delay, no later than 60 days after discovery

‍

The covered entity remains responsible for notifying individuals even when the breach happened at a vendor, although it can delegate the mailing by contract. That is why a vendor notice starts a clock on the provider side.

Where the litigation stands

The Judicial Panel on Multidistrict Litigation consolidated 19 actions against Cognizant and TriZetto as MDL No. 3185 in an order dated June 5, 2026, and assigned them to Judge John A. Ross of the U.S. District Court for the Eastern District of Missouri^[3]. Further actions have been filed since. No settlement has been announced, so no claim form or deadline exists yet.

What healthcare organizations should do now

Find your TriZetto exposure, including fourth-party paths. Check your vendor inventory for TriZetto and for every vendor that routes claims or eligibility checks through it, such as OCHIN.
‍
Confirm what you were told and when. Compare the date of your vendor notice with the 60-day clock, and record who decided whether individual, HHS, and media notice applied.
Review incident reporting terms. Check that contracts set a notice deadline shorter than the HIPAA outer limit and require cause and containment details. In the 2025 benchmarking study of 69 organizations, coverage of Third Party Incident Reporting was 64% and Vendor/Supplier Cybersecurity Requirements was 65%^[5].
Ask the vendor for evidence. Request the cause, the containment steps, any investigation findings the vendor will share, and the date the vendor says access ended.
Record the risk and the remediation. Log the event in your risk register with an owner, a due date, and the follow-up questions for the next assessment.

How Censinet supports third-party breach response

Censinet's third-party risk capability keeps a centralized vendor and product inventory, adds automated rapid inherent risk scoring, sends breach and ransomware notifications focused on the vendors in your inventory, and routes events through an incident review workflow into a Risk Register and a remediation workflow, with people making every final risk decision^[8]. For a breach like this one, those features answer the first question a provider organization faces: do we use this vendor, directly or through another one?

Conclusion

Key points

The TriZetto breach shows how one clearinghouse can expose millions of patients across dozens of provider organizations. Access ran for about eleven months before discovery, the cause is undisclosed, and the notification clock runs from the provider's own discovery date. Providers that know their fourth-party paths and have written incident reporting terms respond faster.

Next steps

Search your inventory for TriZetto and OCHIN today, confirm your notice dates against the 60-day limit, and add incident reporting deadlines to your next vendor contract review.

References

HIPAA Journal. TriZetto Provider Solutions Data Breach (page last modified May 27, 2026). https://www.hipaajournal.com/trizetto-provider-solutions-data-breach/
TechCrunch, Zack Whittaker. TriZetto confirms 3.4M people's health and personal data was stolen during breach (March 6, 2026). https://techcrunch.com/2026/03/06/trizetto-confirms-3-4m-peoples-health-and-personal-data-was-stolen-during-breach/
United States Judicial Panel on Multidistrict Litigation. Transfer Order, In re Cognizant Technology Solutions Corporation and TriZetto Provider Solutions, LLC, Data Security Breach Litigation, MDL No. 3185 (June 5, 2026). https://www.moed.uscourts.gov/sites/moed/files/documents/426md03185-0007.pdf
U.S. Department of Health and Human Services. Breach Notification Rule. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
KLAS Research and Censinet, with the American Hospital Association. Healthcare Cybersecurity Benchmarking Study 2025, Executive Summary (April 2025). https://censinet.com/2025-healthcare-cybersecurity-benchmarking-study-executive-summary
Ponemon Institute, sponsored by Censinet. The Impact of Ransomware on Patient Safety and the Value of Cybersecurity Benchmarking (January 2023). https://censinet.com/ponemon-research-report-the-impact-of-ransomware-on-patient-safety-and-the-value-of-cybersecurity-benchmarking
HIPAA Journal. Healthcare Data Breach Statistics, updated for 2026 (statistics updated October 15, 2026, from OCR data obtained October 10, 2026). https://www.hipaajournal.com/healthcare-data-breach-statistics/
Censinet. Third-Party Risk. https://censinet.com/capabilities/third-party-risk

Which dates and response steps mark the TriZetto investigation, from review of the compromised files to the January 2026 patient letters?

Review window: TriZetto reviewed the compromised files from October 2 through the end of November 2025.
Investigator: TriZetto engaged the cybersecurity firm Mandiant after the suspicious portal activity surfaced.
PHI confirmed: On November 28, 2025, TriZetto learned that the affected data included protected health information.
Client notice: Provider clients began receiving notice from TriZetto on December 9, 2025.
Individual notice: Notification letters reached individuals starting in January 2026.
Containment statement: TriZetto says it removed the threat actor and has detected no further unauthorized portal activity since October 2, 2025.

Which specific data elements did the TriZetto eligibility transaction reports contain, and what services were offered to affected people?

Identity details: Names, addresses, and dates of birth.
Government identifiers: Social Security numbers and, in some cases, Medicare beneficiary numbers.
Coverage identifiers: Health insurance member numbers.
Plan and provider details: Provider names, health insurer names, and primary insured information.
Other fields: Additional demographic, health, and insurance information.
Services offered: Complimentary credit monitoring, fraud consultation, and identity theft restoration services.

What did each state filing report for the TriZetto breach, and how many affected entities did HIPAA Journal list?

Oregon: 3,433,965 individuals, plus 304 tied to Columbia River Health as a business associate.
Maine: A filing reported on March 6, 2026 put the total above 3.4 million people.
Texas: 171,158 residents.
South Carolina: 3,562 individuals.
Counts not published: California, Massachusetts, New Hampshire, and Vermont were notified without published counts.
Entities listed: HIPAA Journal lists 46 affected entities.

Which organizations sit in the TriZetto chain for a health center, and what role does each play?

Parent company: Cognizant owns TriZetto Provider Solutions.
Clearinghouse role: TriZetto is a claims clearinghouse that handles transactions between providers and insurers.
Covered entity: The health center is the covered entity in the chain.
Business associate: OCHIN holds the business associate role between the health center and TriZetto.
Subcontractor: TriZetto is the subcontractor, a fourth party from the health center’s point of view.
Direct paths: Some affected entities are direct business associates of TriZetto rather than OCHIN customers.

Which notice does the HIPAA Breach Notification Rule require from each party after a vendor breach, and by when?

Business associate: Notifies the covered entity or the business associate above it, without unreasonable delay and no later than 60 days after discovery.
Covered entity to individuals: Notifies affected individuals within the same 60-day limit.
Covered entity to HHS: Notifies HHS of breaches affecting 500 or more people, at the same time as individual notice.
Covered entity to media: Notifies prominent media outlets when more than 500 residents of one state are affected.
Media timing: The media notice follows the same without-unreasonable-delay standard and 60-day outer limit.
Rule publisher: HHS publishes the Breach Notification Rule.

What are the docket facts for MDL No. 3185 against Cognizant and TriZetto?

Order date: The Judicial Panel on Multidistrict Litigation issued its transfer order on June 5, 2026.
Actions consolidated: The order consolidated 19 actions.
Defendants: Cognizant Technology Solutions Corporation and TriZetto Provider Solutions, LLC.
Judge: The actions were assigned to Judge John A. Ross.
Court: The U.S. District Court for the Eastern District of Missouri.
Claims status: No claim form or deadline exists yet, and further actions have been filed since the order.

Latest Perspectives from Censinet

October 18, 2026

TriZetto Provider Solutions Reports Data Breach Impacting Healthcare Clients

What happened

What data was involved

How many people were affected

Why a clearinghouse breach reaches so many providers

What HIPAA requires after a vendor breach

Where the litigation stands

What healthcare organizations should do now

How Censinet supports third-party breach response

Conclusion

Key points

Next steps

References

Ready to See Censinet in Action?

Latest Perspectives from Censinet

The SAFER Guides Sat on the Shelf While the EHR Went Dark

PCI Compliant and Still Catastrophically Exposed

The Medical Device Security Gap Healthcare Has Ignored for Years

Ready to See
Censinet in Action?

TriZetto Provider Solutions Reports Data Breach Impacting Healthcare Clients

Article Summary

What happened

What data was involved

How many people were affected

Why a clearinghouse breach reaches so many providers

What HIPAA requires after a vendor breach

Where the litigation stands

What healthcare organizations should do now

How Censinet supports third-party breach response

Conclusion

Key points

Next steps

References

Key Points Summary

Ready to See Censinet in Action?

Latest Perspectives from Censinet

The SAFER Guides Sat on the Shelf While the EHR Went Dark

PCI Compliant and Still Catastrophically Exposed

The Medical Device Security Gap Healthcare Has Ignored for Years

Ready to See Censinet in Action?

Ready to See
Censinet in Action?