How do I know if I am affected by the Aetna data breach?

Aetna is mailing notification letters directly to affected individuals. If you have received care or services from Aetna (also operating as CVS Health (parent)) in the period leading up to February 2026 and you have not received a letter, contact the entity directly. 10,888 individuals were confirmed affected in the HHS OCR filing.

What data was exposed in the Aetna breach?

According to the notification letter and supporting filings, the compromised data included: Member name, Plan / member identifier (inferred from letter context).

Was Aetna attacked by a ransomware group?

No threat actor has publicly claimed responsibility for the Aetna breach. The incident is categorized in the HHS OCR portal as a unauthorized access.

Should I file a lawsuit over the Aetna data breach?

As of the latest update, no class action complaints have been publicly filed against Aetna for this breach. Plaintiffs' firm interest may develop. We are not a law firm and cannot give legal advice.

What is HealthConsent and how does it help with the Aetna breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by Aetna addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Hartford, CT Disclosed February 27, 2026

Aetna Data Breach 2026: 10,888 Members Exposed in Mailing Vendor Error. Minimal PHI. What To Do

Aetna (a CVS Health subsidiary) disclosed in February 2026 two paired 2025 mailing-vendor errors that included member names in letters sent to other plan members. 10,888 + 775 affected (combined 11,663). Root cause was a third-party mailing vendor, not a cyber intrusion. Minimal PHI exposure. Credit monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Jun 15, 2025

Mailing-vendor error events (approximate)

Oct 1, 2025

Aetna identifies the mailing errors

Feb 27, 2026

Filed both breach reports with HHS OCR

Jun 15, 2025

Mailing-vendor error events (approximate)

Oct 1, 2025

Aetna identifies the mailing errors

Feb 27, 2026

Filed both breach reports with HHS OCR

Data exposed

Contact & insurance

Phishing + targeted scams

Member name Plan / member identifier (inferred from letter context)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Aetna is a CVS Health subsidiary and one of the largest US health plans. This is not a cyber intrusion. It is a mailing-vendor error: an unidentified third-party mailing vendor (a HIPAA business associate) sent letters on behalf of two Aetna health plans, and the letters inadvertently included the name of a different plan member alongside the intended recipient’s content.

Aetna filed two paired breach reports with HHS OCR on February 27, 2026 — one affecting 10,888 individuals, the other 775 individuals (combined 11,663). Both were categorized in the OCR portal as “Unauthorized Access/Disclosure” with breached PHI location classified as “Paper/Films” — confirming the mailing-error nature rather than a hacking incident.

CVS Health spokesperson Shelly Bendit publicly confirmed the root cause: “letters sent to members may have inadvertently included an individual that was not on their health plan.” The specific plan names and the mailing vendor identity have not been publicly disclosed.

No external threat actor was involved. No ransomware. No leak-site listing.

What was exposed

Per CVS Health’s public statement, exposure was minimal: the name of another plan member appeared on a recipient’s letter, along with whatever plan-level identifiers the letter context implied (plan name, member-letter framing). No Social Security numbers, no full medical records, and no financial data were exposed per CVS Health’s characterization.

What Aetna is offering

Despite the minimal disclosure, Aetna is offering complimentary credit monitoring and identity-theft protection services (vendor and duration not publicly disclosed in reporting). Additional safeguards added to the mailing-distribution process; enhanced employee training.

What to do

Enroll in the offered monitoring through the activation code in your letter (out of caution, even though the disclosure was minimal).
Review your insurance Explanation of Benefits statements for unfamiliar claims.
Be aware that the disclosure was narrow — this is a low-severity breach compared to most 2026 healthcare events. Heavy defensive action (credit freezes, fraud alerts) is optional rather than essential.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.