TMG Health Data Breach 2026 (Cognizant Subsidiary): 2,076 Health Plan Members Exposed. Parallel to TriZetto Lineage. What To Do

What happened

TMG Health, Inc. is a Business Process Outsourcing (BPO) provider serving Medicare Advantage, Medicare Part D, and Managed Medicaid plans. Services include member enrollment, eligibility, premium billing, claims, customer service, and care management. Founded around 1998, TMG was acquired by Cognizant from Health Care Service Corporation in August 2017 and integrated with Cognizant’s TriZetto healthcare administration platform. At acquisition, TMG supported 32 health plans covering 4.4M+ members.

On November 20, 2024, an unauthorized third party began accessing TMG’s network. The intrusion was discovered on September 19, 2025 — a 10-month dwell time. TMG filed this HHS OCR notification on January 13, 2026 — confirming 2,076 affected individuals.

The 2,076 count is far smaller than the umbrella TMG incident. This filing is almost certainly one downstream health plan client’s slice of members, filed by TMG as the Business Associate for that specific covered entity. Other covered entities are filing separately: VNS Health confirmed 103,775 affected via TMG; Arizona Blue, BCBS New Mexico, BCBS Texas, and VillageCareMAX have also issued downstream notices.

The Cognizant cluster

TMG Health and TriZetto Provider Solutions are both Cognizant subsidiaries with separate-but-parallel breach lineages:

• TriZetto (revenue cycle management for healthcare providers): November 2024 access begin, ~3.4M individuals exposed nationwide
• TMG Health (health plan BPO): November 2024 access begin, ~10-month dwell, downstream notifications cascading through 2026

The parallel timing strongly suggests a common threat actor or shared infrastructure compromise across Cognizant’s healthcare units, though no public attribution links them definitively yet.

Why “Unauthorized Access/Disclosure” not “Hacking/IT”

TMG itself described the incident as “an unauthorized third party had access to its network” — a 10-month network intrusion. The OCR category choice (“Unauthorized Access/Disclosure”) is unusual and likely reflects TMG/Cognizant’s preference, or the downstream covered entity’s characterization (BA disclosure rather than direct hack of its systems).

What was stolen

Per TMG’s downstream client notices:

• Full name
• Member ID number
• Social Security number
• Health information

Broader downstream data (per VillageCareMAX scope):

• Date of birth, driver’s license / government ID
• Medicare / Medicaid ID
• Diagnosis / treatment information, medical record number
• Health insurance information, payment card number, EIN, passport number
• Treating / referring provider
• Biometric data

The biometric data category is unusual and particularly sensitive — biometric identifiers cannot be reissued.

What TMG is offering

• Complimentary credit monitoring and identity theft recovery services to affected individuals
• “Technological and procedural enhancements” implemented

Read your specific notification letter (from TMG or from the downstream health plan) for credit monitoring vendor, duration, and enrollment instructions.

What to do

1. Read your specific notification letter — note whether the sender is TMG Health, Cognizant, or a downstream health plan (VNS Health, AZ Blue, BCBSNM, BCBSTX, VillageCareMAX, etc.).
2. Enroll in the offered credit monitoring through the activation code in your letter.
3. Place free credit freezes at Equifax, Experian, TransUnion. Full SSN is in scope.
4. File IRS Form 14039.
5. Watch your Medicare Summary Notice for unfamiliar claims.
6. If you have biometric data potentially in scope, document the exposure for future fraud claims — biometric identifiers cannot be cancelled or reissued.
7. Stop the ongoing flow of your data through health plan BPOs. HealthConsent files HIPAA restriction requests covering health plan administration and claims-processing pathways.

Continue reading

• Your eight HIPAA rights, in plain English
• TriZetto Provider Solutions Data Breach 2026 (sister Cognizant unit)
• Other 2026 healthcare data breaches