TriZetto Cyberattack Exposes Personal Data of Over 3.4 Million Patients

Health technology company TriZetto, owned by Cognizant, has confirmed that a cyberattack compromised the personal and health information of more than 3.4 million individuals. The breach, which went undetected for nearly a year, began in November 2024 and was only identified on October 2, 2025. TriZetto provides services to approximately 200 million people across 875,000 healthcare providers in the United States, facilitating insurance eligibility checks and other healthcare transactions.

TechCrunch3.4 million hit after TriZetto breach went undetected for nearly a year—now clinics are sending the letters

The stolen data includes sensitive information such as patients' names, dates of birth, home addresses, Social Security numbers, and health insurance details. This information is critical as it can be exploited for identity theft, insurance fraud, or medical fraud. Many affected individuals learned about the breach from their healthcare providers rather than directly from TriZetto, raising concerns about communication and transparency.

3.4 million hit after TriZetto breach went undetected for nearly a year—now clinics are sending the letters

TriZetto began notifying healthcare providers of the breach on December 9, 2025, and offered to assist in notifying affected individuals. However, the notification process is complicated by the Health Insurance Portability and Accountability Act (HIPAA), which requires vendors like TriZetto to inform covered entities, such as hospitals and clinics, before they can notify patients. This two-step process can delay communication, leaving patients unaware of potential risks for extended periods.

3.4 million hit after TriZetto breach went undetected for nearly a year—now clinics are sending the letters

Experts have criticized TriZetto's delayed detection of the breach, attributing it to several factors, including potential monitoring failures and the use of legitimate-looking stolen credentials by attackers. The breach highlights vulnerabilities in the healthcare sector's cybersecurity practices, particularly regarding the detection of abnormal behavior and the need for improved monitoring systems.

3.4 million hit after TriZetto breach went undetected for nearly a year—now clinics are sending the letters

Cognizant spokesperson William Abelson stated that the company has "eliminated the threat" but did not provide details on why it took nearly a year to detect the breach. TriZetto has since secured the affected web portal and claims to have observed no further unauthorized activity.

3.4 million hit after TriZetto breach went undetected for nearly a year—now clinics are sending the letters

In response to the breach, TriZetto is offering free identity monitoring services to those affected, which includes credit monitoring and fraud consultation. Patients are advised to monitor their credit reports and be vigilant about any suspicious activity related to their health insurance or personal information.

3.4 million hit after TriZetto breach went undetected for nearly a year—now clinics are sending the letters

The TriZetto breach underscores a growing concern within the healthcare industry regarding the adequacy of cybersecurity measures. As healthcare vendors play a crucial role in managing sensitive patient data, there is an urgent need for enhanced security protocols to prevent similar incidents in the future. The incident serves as a reminder of the potential risks associated with centralized data management in healthcare.

3.4 million hit after TriZetto breach went undetected for nearly a year—now clinics are sending the letters

• “Why it may have taken so long to detect The timeline is the part that raises the hardest questions: TriZetto says the unauthorized access may have started in November 2024, but wasn’t detected until October 2025.” — TriZetto Statement

3.4 million hit after TriZetto breach went undetected for nearly a year—now clinics are sending the letters

• “43 million affected—an enormous number even in a sector that has grown numb to data incidents.” — Industry Expert

3.4 million hit after TriZetto breach went undetected for nearly a year—now clinics are sending the letters

This incident reflects the ongoing challenges faced by healthcare technology companies in safeguarding sensitive patient information and the critical need for robust cybersecurity measures.

3.4 million hit after TriZetto breach went undetected for nearly a year—now clinics are sending the letters