{"id":"navia-benefits-personal-data-breach-mar-2026","category":"breach","status":"closed","title":"Navia benefits breach exposes personal and health-plan information of about 2.7 million people","tldr":"A Navia benefits breach affected about 2.7 million people, exposing identity and health-plan information. Affected US employees and former employees should check their notice, freeze their credit and review the offered identity protection.","summary":"Unauthorised access to US employee benefits administrator Navia Benefit Solutions between 22 December 2025 and 15 January 2026 affected 2,697,540 people, according to its Maine filing. Potentially exposed information included names, birth dates, Social Security numbers, phone numbers, email addresses and health-plan information; the information involved varied by person. Washington’s Health Care Authority said records extended back to 2018 and that Navia found no evidence of access to claims or bank account information. It also reported that Navia addressed the access flaw and strengthened authentication controls. Written notifications began on 18 March, with 12 months of Kroll protection offered. Navia’s current notice says it is unaware of related identity theft or fraud. Discovery dates differ: Navia’s notice says 23 January, while its Maine filing lists 3 February. Related lawsuits were consolidated; a July order set further court deadlines. The sources reviewed through 3 November do not establish a settlement or final ruling.","action":"If you receive a notice, check which information was involved; call Navia on 844-443-1645 if you need clarification. Freeze your US credit files with Equifax, Experian and TransUnion, and review credit reports and account statements for unfamiliar activity. Follow your letter’s Kroll enrolment instructions and deadline; if it has passed, ask Navia what support remains available.","product":"Navia Benefit Solutions employee benefits administration","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["navia","employee-benefits","data-breach","personal-data","health-data"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Notice of Data Event","url":"https://www.naviabenefits.com/notice-of-data-event/","by":"Navia Benefit Solutions","date":""},{"kind":"advisory","title":"Navia notifies HCA of security breach affecting PEBB and SEBB members","url":"https://www.hca.wa.gov/about-hca/news/announcements/navia-notifies-hca-security-breach-affecting-pebb-and-sebb-members","by":"Washington State Health Care Authority","date":"2026-03-02"},{"kind":"advisory","title":"Notification of Navia data breach","url":"https://content.govdelivery.com/accounts/WAHCA/bulletins/40c7b47","by":"Washington State Health Care Authority","date":"2026-03-03"},{"kind":"advisory","title":"Data Breach Notices: Navia Benefit Solutions, Inc.","url":"https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/584caa6c-4397-49c0-89a5-dbc0dbea0948.html","by":"Maine Attorney General","date":""},{"kind":"news","title":"Navia discloses data breach impacting 2.7 million people","url":"https://www.bleepingcomputer.com/news/security/navia-discloses-data-breach-impacting-27-million-people/","by":"BleepingComputer","date":"2026-03-19"},{"kind":"post","title":"Fisher, et al. v. Navia Benefit Solutions Inc: order regarding amended complaint and response","url":"https://docs.justia.com/cases/federal/district-courts/washington/wawdce/2:2026cv00909/360124/42","by":"US District Court, Western District of Washington, via Justia","date":"2026-07-17"}],"started":"2026-03-02","closed":"2026-07-17","created":"2026-11-03T21:03:07.980Z","updated":"2026-11-03T21:03:07.980Z","cve_notes":[],"timeline":[{"at":"2026-07-17","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"The court set deadlines for an amended consolidated complaint and Navia’s response, with possible dismissal briefing running through 20 November. This was a procedural order, not a finding of liability or a settlement.","url":"https://docs.justia.com/cases/federal/district-courts/washington/wawdce/2:2026cv00909/360124/42","by":"US District Court, Western District of Washington, via Justia","patch":null},{"at":"2026-04-09","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"A federal court consolidated five proposed class actions concerning the breach. A later court order records that eight additional related actions were subsequently consolidated.","url":"https://docs.justia.com/cases/federal/district-courts/washington/wawdce/2:2026cv00909/360124/42","by":"US District Court, Western District of Washington, via Justia","patch":null},{"at":"2026-03-18","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Navia’s Maine filing records written notifications to affected people and a total of 2,697,540 people affected. It lists 12 months of Kroll credit monitoring and identity restoration services.","url":"https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/584caa6c-4397-49c0-89a5-dbc0dbea0948.html","by":"Maine Attorney General","patch":null},{"at":"2026-03-03","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"HCA reported that Navia had addressed the access flaw in late January and strengthened registration and authentication controls. HCA said Navia found no evidence of fund movements or access to claims or bank account information.","url":"https://content.govdelivery.com/accounts/WAHCA/bulletins/40c7b47","by":"Washington State Health Care Authority","patch":null},{"at":"2026-03-02","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"Washington’s Health Care Authority publicly announced the breach. Its announcement, updated on 18 March, described a nationwide incident involving 2.7 million records, including current and former state and school employee benefits members.","url":"https://www.hca.wa.gov/about-hca/news/announcements/navia-notifies-hca-security-breach-affecting-pebb-and-sebb-members","by":"Washington State Health Care Authority","patch":null},{"at":"2026-01-23","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Navia says it discovered suspicious activity and began investigating.","url":"https://www.naviabenefits.com/notice-of-data-event/","by":"Navia Benefit Solutions","patch":null},{"at":"2025-12-22","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Unauthorised access began at Navia Benefit Solutions and continued until 15 January 2026. Navia says personal and health-plan information was accessed and potentially acquired.","url":"https://www.naviabenefits.com/notice-of-data-event/","by":"Navia Benefit Solutions","patch":"na"}],"url":"https://hard.fyi/live/navia-benefits-personal-data-breach-mar-2026/","json":"https://hard.fyi/api/live?id=navia-benefits-personal-data-breach-mar-2026"}