Members of the Leggett & Platt, Incorporated Employee Benefits Plan are receiving notices about a cybersecurity incident at the plan’s pharmacy benefits manager. This page summarizes what has been reported so far.
Leggett & Platt Employee Benefits Plan’s Data Breach Investigation
The Leggett & Platt, Incorporated Employee Benefits Plan is the health benefits program for employees of Leggett & Platt and their covered family members. The incident did not begin at the plan itself. It involves MedImpact Healthcare Systems, Inc., a pharmacy benefits manager that provides services to the plan and keeps certain personal information about members and dependents so that it can process and administer their prescription drug benefits.
According to the notice letters filed with the California Attorney General, on October 18, 2025, MedImpact identified unauthorized activity within certain systems in its environment. The letters say MedImpact moved to secure the affected systems, brought in cybersecurity experts to help with the investigation and response, and then reviewed the data that may have been affected. That review determined that certain data relating to members of the Leggett & Platt plan was included among the potentially affected information.
Published summaries of the matter say MedImpact finished its investigation on July 17, 2026, told affected client organizations on August 13, 2026, and began mailing letters to individuals on September 23, 2026. The notice was posted by the California Attorney General in September 2026, roughly eleven months after the unauthorized activity was first identified. Those later dates come from secondary summaries rather than from the sample letters themselves, so they should be read as reported, not as confirmed by the company’s letter.
Reports citing the U.S. Department of Health and Human Services say that 61,702 individuals were affected, and that all of them were connected to the Leggett & Platt plan. The count appears in consistent form across several published summaries. MedImpact is a vendor to many health plans, and other plans may be notifying their own members separately, so the total number of people affected by the incident across all of the pharmacy manager’s clients has not been published.
MedImpact sent two kinds of letters: one for adult members and a separate one addressed to the parents or guardians of minor dependents. The fact that minors were sent notices means that children’s information was part of the data reviewed. The letters say the information involved varied by individual and included each person’s first and last name together with additional data elements. In the sample filed with the state, the specific data elements are not itemized, so the public record does not say exactly which categories were involved for any one person.
The letters say MedImpact has no reason to believe the information has been or will be misused, and that it has taken steps to strengthen its security safeguards and monitoring. The sample notices filed with the California Attorney General do not describe an offer of complimentary credit monitoring or identity protection. Instead, they enclose general resources that explain how to get a free credit report, place a fraud alert or request a security freeze. MedImpact set up a call line for questions, which is listed in the letters.
Pharmacy benefit managers hold a notable amount of sensitive information. To process prescription claims, they work with member identification numbers, dates of birth, contact details, and records of the medications a person has filled. That prescription history can reveal health conditions a person has not shared with an employer, a family member or anyone else, which is why a breach at a benefits vendor can feel more personal than a typical data theft.
For plan members, an important point is that the vendor, rather than the employer, held the data that was affected. People covered by an employer plan often have no direct relationship with the pharmacy manager and may not recognize its name on a letter. If you received a notice from MedImpact that mentions the Leggett & Platt plan, it is not a scam by default, but it is worth confirming the call line and the mailing details through the plan’s own materials before sharing any information.
When Did This Breach Occur?
MedImpact says it identified the unauthorized activity on October 18, 2025. Published summaries report that it finished its investigation on July 17, 2026, notified affected client organizations on August 13, 2026 and began mailing notices to individuals on September 23, 2026. The notice was posted on the California Attorney General’s site in September 2026.
The long gap between discovery and notice is a common feature of vendor incidents, because the vendor must first work out which clients and which individuals were involved and then pass that information to each client.
What Information Was Breached?
The notice letters say the information involved varied by individual and included each person’s first and last name along with additional data elements identified in that person’s own letter. The sample letters filed publicly do not list those elements.
Because the vendor administers prescription benefits, the information it holds can include health-related details, but the public sample does not confirm which categories were involved for any particular person. Your own letter is the best guide.
What You Can Do
If you received a notice related to Leggett & Platt Employee Benefits Plan or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- If your letter, or your child’s letter, includes the call line for questions, use the number printed in the letter and confirm it against your plan materials.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Leggett & Platt Employee Benefits Plan
Attorneys are reviewing whether MedImpact and the plan took reasonable steps to protect the personal information of employees and their dependents, whether vendor security was properly overseen, and whether affected members were notified promptly. If you or your child received a notice about this incident, you may be able to join a class action. Keep your letter and note the date you received it.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
