City of Phoenix Benefits

Updated: 8/27/2026

November 3, 2025

We have received information about a cybersecurity event involving a City vendor. We want to make you aware of the situation with the information we currently have available. 

What Happened

MedImpact is a company that provides prescription benefits to all employees enrolled in City medical plans. MedImpact has notified its business partners, including the City of Phoenix, that a cybersecurity incident occurred. This incident involved MedImpact systems only. City of Phoenix systems were not compromised.  

What Information Was Involved

MedImpact retained forensic specialists, Kroll, to perform an investigation and later engaged specialized third-party data review providers to analyze potentially impacted files for the presence of personally identifiable information (PII) and protected health information (PHI).

The potentially impacted data varies by individual. It included the individual's name and, depending on the records, may have also included personal identifiers such as address, date of birth, subscriber numbers, as well as limited health-related information including prescription information, insurance identification numbers, and in limited instances, Social Security numbers. It is important to note that the investigation has not uncovered any evidence to suggest there has been identity theft or fraud relating to this event.  

What You Can Do

If you have any questions regarding the specifics of the cybersecurity incident, we encourage you to contact MedImpact directly at 1(833) 803-4402. More information can be found at: MedImpact Statement Regarding Cybersecurity Incident | MedImpact. Human Resources Benefits Division leadership is working closely with MedImpact and will post updates to the City’s public benefit website as information becomes available.  

Letters have been sent by the City of Phoenix to all members potentially impacted.  MedImpact will be sending letters to impacted members in September 2026.