Trizetto Notifying 3.4M of 2024 Hack Detected in 2025

Billing services vendor TriZetto Provider Solutions is notifying more than 3.4 million individuals of a hacking incident discovered in October 2025 that investigators have now determined started nearly a year earlier, when threat actors began accessing the company’s healthcare clients’ insurance related data.

See Also: Reduce Cloud Risk in Healthcare with Security by Default

TriZetto, a Missouri-based revenue cycle management software business unit and claims clearinghouse of Cognizant, first publicly confirmed in December that it had experienced a hacking incident affecting some of its healthcare clients (see: FieldTex, TriZetto Reveal New Healthcare Breaches).

The U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool website shows TriZetto reported the hacking incident on Feb. 6 as affecting more than 3.43 million individuals. TriZetto has not publicly disclosed how many of its healthcare clients were affected by the incident. Dozens have publicly stated they have been affected by the hack or have issued their own notices to affected patients about the breach.

That includes Portland, Oregon-based behavioral health and substance disorder services provider Cascadia Health, which said in a February notice that the TriZetto hack affected about 1,800 of its patients.

“TriZetto is a company that provides billing services to OCHIN Epic, the company that manages Cascadia’s electronic health record system. The breach did not occur within Cascadia and did not impact any internal systems at Cascadia.”

Other affected TriZetto clients include community health clinics such as San Jose, Calif.-based Gardner Health Services and San Francisco Community Health Center.

OCHIN in a statement to Information Security Media Group said it estimates that about 9% of OCHIN’s member network’s patient population was impacted. The company did not specify a number of clients or patients affected.

Breach Details

TriZetto said in notification letters to affected individuals that on Oct. 2, 2025, it become aware of suspicious activity within a web portal used by some of its healthcare clients to access the company’s systems.

An investigation into the incident determined that beginning nearly a year earlier, in November 2024, threat actors started accessing records related to insurance eligibility verification transactions that its healthcare clients use to assess coverage for patient treatments.

Patient information compromised in the incident varies among individuals but potentially includes names, addresses, birthdates, Social Security numbers, health insurance member numbers, provider names, health insurer names, primary insured information and health data.

The breach did not include any payment card, bank account, or other financial information, TriZetto said.

The company said it notified law enforcement about the incident and has since implemented “additional security protocols” to enhance its data security.

Slow Going

Experts said there are factors that often play into delays in detecting the presence of hackers.

“Key risk drivers that create such delays include the use of unreported stolen credentials, and overemphasis on data loss prevention defenses instead of behavior monitoring, and alert fatigue by cybersecurity teams,” said Steven Adler, partner at consulting firm The Edmund Group and a former risk management executive at health insurer Humana.

“As a result, hackers who take a ‘low and slow strategy’ in data exfiltration are less likely to be detected,” he said.

Depending on the volume of protected information involved and details of the exfiltration, the work involved in breach investigation can be significant, he said.

That includes of analysis of distributed data assets, conducting both federal and state risk of harms to understand regulatory obligations and requirements for notification, identifying customers affected and developing both internal and external communications, he said.

As of Thursday, TriZetto and co-defendant Cognizant were facing nearly two dozen proposed federal class action lawsuits involving the data breach. Among the claims are allegations that TriZetto was negligent in failing to protect plaintiff and class members’ sensitive personal information from cyber attackers, putting the individuals at risk for identity theft and fraud crimes.

The lawsuits seek financial damages as well as injunctive relief requiring TriZetto to improve its data security practices.