TriZetto

Summary

TriZetto confirmed that a cyberattack resulted in the theft of personal and health information for more than 3.4 million individuals, including names, dates of birth, addresses, Social Security numbers, provider details and insurance data. The attackers maintained access to the company’s systems for an extended period before the breach was identified, and the threat was later eliminated. Not all of the company’s customers were affected, but organizations such as OCHIN and several California healthcare providers have verified that their patients’ data was compromised. Owned by Cognizant, the firm joined a series of recent health‑tech breaches that have exposed millions of records.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

TriZetto, a health technology company owned by Cognizant, serves approximately 200 million people through 875,000 healthcare providers across the United States. In a 2024 cyberattack, attackers gained unauthorized access to TriZetto’s servers and remained undetected for nearly a year. The intruders exfiltrated patients’ insurance eligibility transaction reports, which contain names, dates of birth, home addresses, Social Security numbers, provider names, demographic data, and health and insurance details. TriZetto disclosed the breach in a filing with the Maine attorney general’s office on Friday, stating that the compromise was identified on October 2, 2025. Subsequent investigation revealed that the attackers had first accessed the network as early as November 2024.

TriZetto confirmed that more than 3.4 million individuals had their personal and health information stolen in the incident. The company noted that not all of its customers were affected, although it did not disclose the exact proportion of impacted versus unaffected clients. Affected parties include OCHIN, a nonprofit consultancy that provides technology to approximately 300 rural and community care providers across the United States, which verified that its patients’ data were among those compromised. Several healthcare providers located in California also reported that their patients’ information appeared in the stolen data set.

In response to the discovery, TriZetto stated that it had eliminated the threat from its environment. A Cognizant spokesperson, William Abelson, confirmed the containment effort but declined to explain why the breach remained undetected for approximately twelve months. The incident follows a 2024 ransomware attack on Change Healthcare that compromised over 192 million patient files and caused widespread service disruptions across the United States. TriZetto’s filing with the Maine attorney general’s office satisfies state breach‑notification requirements and provides a formal record of the data elements that were accessed. No further details regarding the attackers’ identity, motives, or the specific technical methods employed have been released by the company or its parent organization.

Sources

Sources available to members: 1 source.