Navia Benefit Solutions

Disclosed Mar 18, 20262,697,540 affectedConfirmed

Navia benefits breach exposes SSNs of 2.7 million people

Benefits administrator Navia said attackers accessed its systems between December 22, 2025 and January 15, 2026 and notified nearly 2.7 million people whose names, SSNs and FSA, HRA or COBRA details were exposed. Client HackerOne said the flaw was a broken object level authorization bug.

What is known

People affected	2,697,540 (as reported by the organization)
Disclosed	Mar 18, 2026
Discovered	Jan 23, 2026
Happened	Dec 22, 2025
Attack	Hacking
Data exposed	NamesHealthDates of birthSocial Security numbersPhone numbersEmailsInsuranceAddresses
Sector	Finance · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Navia Benefit Solutions

Official noticeatg.wa.gov

Washington Attorney General breach notice: Navia Benefit Solutions

Official noticeattorneygeneral.delaware.gov

Notice letter filed with the Delaware DOJ: Navia Benefit Solutions

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Navia Benefit Solutions

Official noticeocrportal.hhs.gov

HHS OCR breach report: Navia Benefit Solutions (Business Associate, WA)

Newsbleepingcomputer.com

Navia discloses data breach impacting 2.7 million people

Official noticeoag.my.site.com

Texas Attorney General data security breach report BR-0004920: Navia Benefit Solutions

Official noticeago.vermont.gov

Vermont Attorney General: 2026-03-18 Navia Benefit Solutions Data Breach Notice to Consumers

Official noticein.gov

Indiana Attorney General 2026 data breach report: Navia Benefit Solutions

Notices filed

Residents of CAMar 18

California AGCount not stated

Residents of WAMar 18

Washington AG319,208 people

Residents of DEMar 18

Delaware DOJ599 people

Residents of ORMar 18

Oregon DOJ2,697,540 people

TotalMar 18

HHS OCR2,151,330 people

Residents of VTMar 18

Vermont AGCount not stated

Residents of INMar 18

Indiana AG6,088 people

TotalMar 19

ResearchCount not stated

Residents of TXMar 20

Texas AG62,821 people

History of this record

source2026-09-25

empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-7_2026.pdfby backfillSource

source2026-09-25

empty to https://ago.vermont.gov/document/2026-03-18-navia-benefit-solutions-data-breach-notice-consumersby backfillSource

data_types2026-09-25

["names","health","dob","ssn","phone","emails","insurance"] to ["names","health","dob","ssn","phone","emails","insurance","addresses"]by backfillSource

records_basis2026-09-25

hhs to organizationby backfillSource

records2026-09-25

2151330 to 2697540by backfillSource

sector2026-09-25

health to financeby seedSource

data_types2026-09-25

["names","health"] to ["names","health","dob","ssn","phone","emails","insurance"]by seedSource

summary2026-09-25

empty to Benefits administrator Navia said attackers accessed its systems between December 22, 2025 and January 15, 2026 and notified nearly 2.7 million people whose names, SSNs and FSA, HRA or COBRA details were exposed. Client HackerOne said the fby seedSource

title2026-09-25

empty to Navia benefits breach exposes SSNs of 2.7 million peopleby seedSource

sector2026-09-25

other to healthby backfillSource

data_types2026-09-25

["names"] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 2151330by backfillSource

data_types2026-09-25

[] to ["names"]by backfillSource

attack2026-09-25

unknown to hackingby backfillSource

discovered2026-09-25

empty to 2026-01-23by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Navia Benefit Solutions