How do I know if I am affected by the illumifin Corporation data breach?

illumifin Corporation is mailing notification letters directly to affected individuals. If you have received care or services from illumifin Corporation in the period leading up to March 2026 and you have not received a letter, contact the entity directly. 5,385 individuals were confirmed affected in the HHS OCR filing.

What data was exposed in the illumifin Corporation breach?

According to the notification letter and supporting filings, the compromised data included: Full name, Home address, Social Security number, Date of birth, Insurance policy information, Underwriting and claims data, Health insurance information, Medical record information, Financial account number.

Was illumifin Corporation attacked by a ransomware group?

No threat actor has publicly claimed responsibility for the illumifin Corporation breach. The incident is categorized in the HHS OCR portal as a hacking.

What is HealthConsent and how does it help with the illumifin Corporation breach?

HealthConsent is an independent health-data privacy service. We help affected individuals stop the ongoing flow of their health information by filing HIPAA restriction requests, FTC Health Breach Notification Rule deletion requests, and state-law deletion requests across providers, insurers, Health Information Exchanges, prescription networks, and data brokers. Credit monitoring offered by illumifin Corporation addresses identity-theft risk; HealthConsent addresses the longer-tail problem of your exposed health data continuing to be sold and shared by other entities downstream.

Active breach tracker Woodbury, MN / Greenville, SC Disclosed March 13, 2026 Part of illumifin TPA cluster

illumifin Corporation Data Breach 2026: 5,385 Minnesota Policyholders Exposed (97,781 Aggregate). Liberty Bankers TPA Vendor. What To Do

Q: Should I file a lawsuit over the illumifin Corporation data breach?

4 plaintiffs' firms have publicly announced investigations or filed complaints related to the illumifin Corporation breach: Lynch Carpenter LLP (publicly investigating), Migliaccio & Rathod LLP (publicly investigating), Zimmerman Reed (publicly investigating), Bryson Harris Suciu & DeMay (publicly investigating). We are not a law firm and cannot give legal advice; consult your own attorney to evaluate your options.

illumifin Corporation, a third-party administrator serving 100+ life, long-term care, health, and annuity carriers, disclosed in March 2026 a November 2025 network intrusion exposing names, Social Security numbers, dates of birth, insurance policy data, underwriting and claims data, medical records, and financial accounts for 5,385 individuals in Minnesota (97,781 aggregate across all carriers). 1-2 years identity monitoring offered. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated May 15, 2026 Sources & methodology

Timeline

Nov 4, 2025

Unusual network activity detected; IR initiated; forensics engaged

Nov 4, 2025

Attacker gained access

Nov 10, 2025

Forensics confirms files contained client / carrier data

Jan 9, 2026

illumifin notifies affected insurance carrier clients

Feb 25, 2026

Provides clients with affected-individual lists

Mar 13, 2026

Individual notification mailing begins

Mar 13, 2026

Disclosed publicly

Mar 31, 2026

California AG breach notice filed

Data exposed

High-risk identity

Enables financial + identity theft

Social Security number Date of birth

Health records

Don't expire and can't be reissued

Medical record information

Contact & insurance

Phishing + targeted scams

Full name Home address Insurance policy information Underwriting and claims data Health insurance information Financial account number

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Lynch Carpenter LLP (publicly investigating) Migliaccio & Rathod LLP (publicly investigating) Zimmerman Reed (publicly investigating) Bryson Harris Suciu & DeMay (publicly investigating)

If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

Accept credit monitoring

It’s the floor of the response. Take it.

Freeze your credit

Free at Equifax, Experian, TransUnion.

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

Review your EOBs

Insurance statements catch medical identity theft early.

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

illumifin Corporation is a third-party administrator (TPA) serving more than 100 insurance carriers in life, long-term care, health, and annuity lines. Its functions include policy administration, underwriting support, claims assessment, and policyowner services. Sources conflict on illumifin’s primary headquarters — HHS OCR and Minnesota state filings list Woodbury, MN; California filings reference Greenville, SC. The MN-listed OCR filing of 5,385 affected individuals is the entry covered on this page.

On November 4, 2025, illumifin detected unusual network activity, initiated incident response, and engaged forensic experts. On November 10, 2025, forensics confirmed that exfiltrated files contained client / carrier data. illumifin notified affected insurance carrier clients on January 9, 2026 and provided them with affected-individual lists by February 25, 2026. Individual notification mailing began on March 13, 2026, and illumifin filed with the California AG on March 31, 2026.

Aggregate exposure across all illumifin clients is 97,781 individuals, distributed across state filings: TX 6,724, IN 1,903, SC 786, NH 37, MA 21, plus the MN 5,385 covered here. A separate OCR filing under Liberty Bankers Life lists 20,202 additional affected individuals — that’s a downstream carrier filing covered on its own page.

No ransomware group has publicly claimed responsibility. No leak-site listing has been observed. The behavior pattern (network intrusion + file exfiltration + multi-month dwell to notification) is consistent with extortion-style intrusion.

What was stolen

Full name, home address
Social Security number
Date of birth
Insurance policy information
Underwriting and claims data
Health insurance information
Medical record information
Financial account number

The combination of SSN + medical records + financial accounts represents a broad TPA-typical exposure — life, long-term care, and annuity policy data are particularly attractive for fraud given the asset values and beneficiary information involved.

What illumifin is offering

Complimentary identity-monitoring membership: 1-year coverage for some affected individuals, 2-year coverage for others depending on data-sensitivity tier per individual

What to do

Enroll in the offered identity monitoring through the activation code in your letter.
Place free credit freezes at all three bureaus. Full SSN is in scope.
File IRS Form 14039.
Cancel and reissue any payment cards that may be tied to financial account information.
Watch your insurance Explanation of Benefits statements for unfamiliar claims.
Stop the ongoing flow of your insurance and medical data through TPAs. HealthConsent files HIPAA restriction requests covering insurance administration and claims-processing data flows.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.