MEDIMPACT DATA BREACH: Edelson Lechtzin LLP Launches Investigation Into Exposure of Social Security Numbers and Health Information

National class action firm Edelson Lechtzin LLP is offering free case evaluations to individuals affected by the MedImpact Healthcare Systems data breach, which may have exposed names, Social Security numbers, and sensitive health information.

SAN DIEGO, Sept. 26, 2026 /PRNewswire/ -- Edelson Lechtzin LLP, a national class action law firm, is investigating data privacy claims arising from the MedImpact Healthcare Systems, Inc. data breach. MedImpact is a privately held pharmacy benefit manager serving millions of members nationwide. The breach exposed sensitive personal and health information of current and former members of pharmacy benefit plans administered by MedImpact and/or Elixir Solutions.

Key Facts at a Glance

• Company: MedImpact Healthcare Systems, Inc. is one of the largest independent pharmacy benefit managers in the United States.
• When it happened: MedImpact identified unauthorized activity in its systems on October 18, 2025. It finalized its investigation on July 17, 2026.
• When disclosed: MedImpact notified affected clients on August 13, 2026, and began mailing notices to affected individuals on September 23, 2026.
• People affected: Not publicly disclosed. Impacted members include adults and minor dependents covered under affected benefit plans, including the Leggett & Platt, Inc. Employee Benefits Plan.
• Information exposed: Varied by individual and may include names, Social Security numbers, and sensitive health information (see below).

What Happened

MedImpact identified unauthorized activity within certain systems on October 18, 2025, secured the affected systems, and engaged cybersecurity experts to investigate. The Qilin ransomware group claimed responsibility on October 27, 2025, adding MedImpact to its dark web leak site and claiming it had stolen data, which it threatened to publish unless a ransom was paid.

What Information Was Exposed

The compromised data varied by individual and may include names, addresses, dates of birth, Social Security numbers, subscriber and insurance identification numbers, and health-related information such as prescriptions, treatment, dates of service, service locations, and provider names. Because Social Security numbers and protected health information are highly sensitive, affected individuals face a lasting risk of identity theft, medical fraud, insurance fraud, and targeted phishing.

Your Legal Options

Edelson Lechtzin LLP is investigating a potential class action to pursue legal remedies for individuals whose sensitive personal and health data may have been compromised. The firm is examining whether MedImpact implemented reasonable cybersecurity safeguards and whether additional measures could have prevented or reduced the breach's impact. The firm will evaluate your rights and potential claims at no cost.

Recommended Protective Steps

• Preserve your breach notification letter and enroll in any complimentary credit monitoring offered to you.
• Monitor your account statements, credit reports, and explanation-of-benefits statements for unauthorized activity.
• Consider placing a fraud alert or security freeze with Equifax, Experian, and TransUnion.
• Be cautious of phishing calls, texts, and emails referencing the breach.

Contact Us for a Free Case Evaluation

Speak confidentially with a data privacy attorney today: Marc Edelson, Esq., Edelson Lechtzin LLP, 411 S. State Street, Suite N-300, Newtown, PA 18940; Phone: 844-696-7492; Email: [email protected]; or click HERE to request a free consultation.

About Edelson Lechtzin LLP

Edelson Lechtzin LLP is a national class action law firm with offices in Pennsylvania and California. In addition to data breach litigation, the firm handles class and collective actions involving securities and investment fraud, federal antitrust violations, ERISA employee benefit plans, wage theft, and consumer fraud.

Legal Notice: This press release may be considered Attorney Advertising in some jurisdictions.

SOURCE Edelson Lechtzin LLP