TriZetto Data Breach Exposes 3.4 Million Patient Records
▼ Summary
– A data breach at IT firm TriZetto Provider Solutions (TPS) compromised the personal and health insurance information of over 3.4 million individuals.
– The breach, discovered in October 2025, involved a suspicious activity in a web portal used by TPS’s healthcare provider customers.
– Exposed data includes names, Social Security numbers, dates of birth, health insurance details, and other demographic and health information, but no financial data.
– TPS has initiated investigations, implemented additional security protocols, and is offering credit monitoring to those affected.
– Parent company Cognizant has a history of security incidents, including a costly 2020 ransomware attack and a 2023 breach lawsuit from client Clorox.
A significant data security incident at TriZetto Provider Solutions (TPS), a major healthcare IT firm, has resulted in the exposure of sensitive personal and insurance information belonging to millions of patients. The breach, which impacted over 3.4 million individuals, was disclosed through a filing with the Office of the Maine Attorney General. TPS, a subsidiary of Cognizant Technology Solutions, offers critical software for claims management and billing to a wide range of healthcare organizations, including hospitals, physician groups, and insurance companies.
The company identified unusual activity within a specific customer web portal on October 2, 2025. While the investigation confirmed that no financial data like payment card or bank account details were accessed, the compromised information is extensive and highly sensitive. The exposed data includes names, addresses, dates of birth, and Social Security numbers. It also encompasses detailed health insurance information such as member numbers, Medicare identifiers, provider names, insurer details, and other demographic and health-related data.
In response to the discovery, TPS initiated investigations with law enforcement and external security partners. The firm has stated it has now implemented additional security protocols, though the specific nature of these enhancements remains unclear. TPS’s public materials note its platform holds certifications including SOC 2, EHNAC, and HITRUST. As a remedial measure for those affected, the company is offering complimentary credit monitoring and identity protection services.
This incident is not the first cybersecurity challenge for parent organization Cognizant. The company faced a major ransomware attack by the Maze group in April 2020, an event that led to estimated costs between $50 and $70 million. More recently, Cognizant was involved in litigation following a 2023 cyber attack on one of its clients, cleaning products giant Clorox. A lawsuit alleges that a Cognizant helpdesk employee improperly reset a password, bypassing security protocols and allowing a threat actor to infiltrate Clorox’s network. The breach reportedly resulted in losses of around $49 million for Clorox.
The scale of the TPS breach underscores the persistent vulnerabilities within the healthcare technology supply chain, where a single point of failure can jeopardize the private data of millions. It highlights the critical need for rigorous third-party vendor risk management and continuous security validation, even when dealing with certified and established service providers. For the millions of affected patients, the fallout involves a heightened risk of medical identity theft and fraud, necessitating vigilant monitoring of their insurance statements and credit reports for years to come.
(Source: InfoSecurity Magazine)
