Breaches and incidentsBriefReported by a reputable outlet, citing the company
Navia Benefit Solutions: benefits administrator breach affects 2.7 million, including state employees and school districts
Unauthorized access ran from 22 Dec 2025 to 15 Jan 2026.
- Disclosed
What happened
- Unauthorized access ran from 22 Dec 2025 to 15 Jan 2026. Navia’s Maine AG notice lists 2,697,540 affected; it told HHS OCR 2,151,330. Data: names, emails, phone numbers, SSNs; the Washington State Health Care Authority’s notice adds addresses, IDs, enrollment dates and dates of birth going back seven years. Clients include Washington’s HCA (PEBB/SEBB members) and 37 school districts.
- Root cause: not disclosed by Navia (some roundups describe an exposed API; not confirmed in the notices checked).
- Attacker: unknown; no group claimed it.
- Response: substitute notice 13 Mar, letters from 18 Mar, 12 months of credit monitoring, law enforcement notified.
Sources
- https://www.hipaajournal.com/navia-benefit-solutions-data-breach/
- https://www.cm-alliance.com/cybersecurity-blog/biggest-cyber-attacks-data-breaches-ransomware-attacks-of-march-2026
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.