Quantum Health experienced a data security incident. This notice explains the incident, measures we have taken, and some steps individuals can take in response
What happened?
On June 1, 2026, Quantum Health detected a service outage, which affected the availability of certain internal and external systems. Upon identifying the outage, we promptly secured and isolated our systems, while simultaneously launching an investigation with the support of third-party forensics experts. We also reported the incident to federal law enforcement. We immediately took measures to continue supporting members while we completed our restoration efforts.
Our investigation determined that the service outage was related to unauthorized access to our IT network, resulting from a user responding to a vishing call on May 29, 2026. Between May 29, 2026 and June 1, 2026, the unauthorized party accessed and acquired files from certain Quantum Health systems.
What information was involved?
Our investigation has determined that some of the files involved in the incident contained individuals’ names and one or more of the following: health insurance information (such as insurance policy number or claims/benefits information), health information (such as medical information, treatment information, diagnoses, prescriptions, provider names, and dates of service), and other personal information (such as date of birth, email, address, phone number, or demographic information).
What are we doing?
Quantum Health is committed to protecting the confidentiality and security of the information we maintain. We are contacting individuals to let them know this happened. To help prevent a similar occurrence in the future, we are enhancing our existing security protocols and implementing additional security measures. Individuals whose information was involved will receive a notification letter that provides more details about the event, the data involved and measures individuals may take in response. We are providing affected individuals complimentary credit monitoring, dark web monitoring, and identity theft restoration services.
We also established a dedicated, toll-free incident response line to answer questions that individuals may have. If an individual believes their information was involved and has any questions about the incident, please call (844) 958-8913, Monday through Friday, between 9:00 a.m. and 6:30 p.m., Eastern Time, excluding major U.S. holidays.
Frequently asked questions
How will I know if my information was involved?
If your information was involved, you will receive an official notification letter, which includes information about how to access an online portal that will have more details about the event, the data involved, what you may need to do, and the identity monitoring services and resources available.
What are you doing to help me?
We are providing affected individuals with complimentary credit monitoring, dark web monitoring, and identity theft restoration services. Please [refer to your individual notice letter/visit ID monitoring URL] to activate and take advantage of your identity monitoring services.
What is “vishing”?
Vishing is short for voice phishing or phone spoofing. Vishing, or phone spoofing, is when a caller pretends to be someone they are not in order to obtain account credentials.
Is it safe to use Quantum Health’s systems?
Our systems have been restored and are safe for use.
What steps are you taking to prevent this from happening again?
To help prevent a similar incident from occurring in the future, Quantum Health is enhancing its existing security protocols and implementing additional security measures
Has the information been used to commit fraud?
At this time, we have no evidence that impacted information has been publicly posted or exposed on the Internet.