TriZetto Confirms 2024 Cyberattack Exposing 3.4 Million Patients’ Data Health technology firm TriZetto, a subsidiary of Cognizant, disclosed a 2024 cyberattack that compromised the personal and health information of over 3.4 million individuals. The breach, detected on October 2, 2025, remained undetected for nearly a year, with hackers gaining access as early as November 2024. TriZetto, which processes insurance eligibility transactions for 200 million patients across 875,000 U.S. healthcare providers, confirmed in a filing with Maine’s attorney general that stolen data included names, dates of birth, addresses, Social Security numbers, provider details, and insurance information. The company stated that not all customers were affected. Affected organizations include OCHIN, a nonprofit serving 300 rural and community care providers, as well as multiple California-based healthcare entities. Cognizant confirmed the threat was neutralized but did not explain the delayed detection. This incident follows the 2024 ransomware attack on Change Healthcare, which disrupted U.S. medical services and exposed 192 million patient records. TriZetto’s breach underscores ongoing vulnerabilities in the healthcare sector’s cybersecurity defenses.

Lawsuit Alleges One Community Health Failed to Protect Patient Data in TriZetto Breach A patient of One Community Health in Sacramento has filed a class-action lawsuit, accusing the nonprofit health system of failing to safeguard sensitive patient data after a breach at TriZetto, a health IT vendor. The incident, which occurred in November 2024, went undetected until October 2025, when unauthorized access to patient records was publicly disclosed. TriZetto, a subsidiary of Cognizant, provides claims management and payer billing solutions. One Community Health (legally named Cares Community Health) used TriZetto’s services to handle patient and insurance billing, sharing records that included names, birth dates, Social Security numbers, insurance details, and treatment information. The lawsuit alleges these records were stored offsite by the vendor without adequate encryption or security measures. Plaintiff Scott Carucci, a One Community Health patient, claims his data was compromised in the breach. His lawsuit, filed on January 15, seeks class-action status, arguing that the health system’s alleged negligence including sharing unencrypted data and failing to vet TriZetto’s security practices enabled the attack. The complaint contends that stronger cybersecurity measures could have prevented the breach. The case underscores growing legal and regulatory scrutiny over third-party vendor risks in healthcare data security.