Cognizant subsidiary suffers massive healthcare data theft - AI News Today Recency

# Cognizant Subsidiary Suffers Massive Healthcare Data Theft: 3.4 Million Affected

Cognizant Technology Solutions' healthcare IT subsidiary, TriZetto Provider Solutions, has become the center of one of 2025's largest healthcare data breaches, exposing the personal information of more than 3.4 million individuals[6]. The incident has triggered multiple class-action lawsuits across federal courts in New Jersey and Missouri, with allegations of negligence in data protection and delayed breach notification[1].

Year-Long Security Vulnerability Exposed Patient Data

The breach timeline reveals a critical security failure spanning nearly a year. Hackers gained unauthorized access to TriZetto's systems as early as November 2024, but Cognizant did not discover the intrusion until October 2, 2025—an 11-month exposure window[1]. A hacker used a web portal to access the company's systems, according to county officials who investigated the incident[7].

During this extended period, cybercriminals accessed sensitive healthcare data including Social Security numbers, financial account information, home addresses, patient names, birth dates, and insurance details[1][3]. The prolonged vulnerability underscores serious gaps in Cognizant's security monitoring capabilities and incident response protocols. TriZetto Provider Solutions helps insurers manage claims and develop insurance plans, making it a high-value target for attackers seeking access to comprehensive patient health information[4].

Legal Consequences Mount for Cognizant and TriZetto

Cognizant faces significant legal consequences as plaintiffs from Arizona, California, and other states pursue class-action litigation[1]. The lawsuits allege that Cognizant and TriZetto failed to implement industry-standard security measures necessary to safeguard personal information and violated their obligations to notify affected individuals promptly upon discovering the breach[1].

The delayed notification prevented victims from taking protective steps against identity theft and fraud, according to legal filings. Class-action lawsuits were filed in January 2026, alleging the companies' negligence in data protection[5]. As litigation progresses, courts will likely scrutinize whether Cognizant's response met legal and ethical standards, potentially setting precedent for healthcare data protection requirements across the industry[1].

Industry Implications and Company Response

The breach underscores escalating risks within the healthcare IT sector, where vendors manage vast repositories of patient records and insurance information[1]. Despite mounting pressure, Cognizant and TriZetto have stated that data security remains a core priority. A TriZetto spokesperson acknowledged the incident, saying the company "takes the protection of information very seriously and regrets any inconvenience this incident may have caused," but declined further comment citing active litigation[1].

The company's public disclosures have provided minimal information about the breach's root cause or remediation efforts, drawing additional criticism from plaintiffs[1]. This lack of transparency has intensified scrutiny on how healthcare IT vendors handle security incidents and communicate with affected individuals.

Frequently Asked Questions

How many people were affected by the TriZetto data breach?

More than 3.4 million individuals had their personal information exposed in the TriZetto data breach, making it one of the largest healthcare data breaches of 2025[6].

What types of personal information were stolen?

The breached data included names of patients and primary insureds, along with addresses, birth dates, Social Security numbers, and financial account information[3][1].

When did the breach occur and when was it discovered?

Hackers gained unauthorized access to TriZetto's systems as early as November 2024, but Cognizant did not discover the intrusion until October 2, 2025, creating an 11-month exposure window[1].

How many lawsuits has Cognizant faced?

Cognizant is defending against at least three class-action lawsuits filed in federal courts across New Jersey and Missouri[1].

What are the main allegations in the lawsuits?

Plaintiffs allege negligence in data protection, failure to implement industry-standard security measures, and delayed breach notification that prevented victims from taking protective steps against identity theft and fraud[1].

What did TriZetto say about the breach?

A TriZetto spokesperson stated that the company "takes the protection of information very seriously and regrets any inconvenience this incident may have caused," but declined further comment citing active litigation[1].