MPOWERHealth reports possible exposure of health and identity data after network intrusion
MPOWERHealth detected unauthorized access to part of its network in June 2025. It began notifying people on November 13, 2026 after identifying files that may contain sensitive personal or health data.
- Disclosed
- Nov 13, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- People named in MPOWERHealth’s notification about files accessible during the network intrusion.
- Data breach · Personal information
- In the wild
- Yes
- MPOWERHealth confirmed unauthorized access; individual data scope varies.
What happened
MPOWERHealth says the unauthorized party reached a limited part of its internal network. The company does not disclose the entry method or a victim total. Potentially affected fields differ by person and include names, birth dates, Social Security numbers, driver’s license or government identification numbers, financial account information, and medical or insurance data. The company reports no evidence of medical-information misuse.
Crime-scene timeline
Jun 26, 2025
MPOWERHealth detects the intrusion
The company says it secured its network, notified law enforcement and brought in external investigators.
Oct 20, 2026
The review identifies possibly affected personal data
The affected fields vary by individual and may include health and financial information.
Nov 13, 2026
MPOWERHealth publicly describes the incident and starts notifications
The company opens a dedicated inquiry line and gives steps to check for misuse.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- MPOWERHealth November 13 noticePrimaryIdentifies the investigation dates, possible data fields, contact and protective steps.
- California Attorney General filingPrimaryLists June 23 and 26, 2025 incident dates and the company’s notice.