Major breach at medical billing giant sees data on 5.4 million users stolen - here's what we know

• Episource suffered a cyberattack in late January 2025
• Sensitive data on 5.4 million people was taken
• The company is now notifying affected individuals

American healthcare data giant Episource has begun notifying its customers about a February 2025 data breach in which their sensitive information was stolen.

Episource is a healthcare data and technology company that helps health plans manage risk adjustment, quality measurement, and clinical data through analytics, coding, and technology solutions.

On February 6, 2025, the company spotted a threat actor breaching its defenses and accessing sensitive files it had stored on its devices. After shutting down the IT network, bringing in third-party forensics experts, and notifying law enforcement, the company determined that the attackers took “copies of some data” between January 27 and February 6, 2025.