Navia benefits breach exposes personal and health-plan information of about 2.7 million people
A Navia benefits breach affected about 2.7 million people, exposing identity and health-plan information. Affected US employees and former employees should check their notice, freeze their credit and review the offered identity protection.
If you receive a notice, check which information was involved; call Navia on 844-443-1645 if you need clarification. Freeze your US credit files with Equifax, Experian and TransUnion, and review credit reports and account statements for unfamiliar activity. Follow your letter’s Kroll enrolment instructions and deadline; if it has passed, ask Navia what support remains available.
What’s happening
Unauthorised access to US employee benefits administrator Navia Benefit Solutions between 22 December 2025 and 15 January 2026 affected 2,697,540 people, according to its Maine filing. Potentially exposed information included names, birth dates, Social Security numbers, phone numbers, email addresses and health-plan information; the information involved varied by person. Washington’s Health Care Authority said records extended back to 2018 and that Navia found no evidence of access to claims or bank account information. It also reported that Navia addressed the access flaw and strengthened authentication controls. Written notifications began on 18 March, with 12 months of Kroll protection offered. Navia’s current notice says it is unaware of related identity theft or fraud. Discovery dates differ: Navia’s notice says 23 January, while its Maine filing lists 3 February. Related lawsuits were consolidated; a July order set further court deadlines. The sources reviewed through 3 November do not establish a settlement or final ruling.
- What
- Breach
- Affects
- Navia Benefit Solutions employee benefits administration
- Fixed in
- Nothing to patch
- Since
- 2 Mar 2026
- Closed
- 17 July 2026
Timeline
- Update
The court set deadlines for an amended consolidated complaint and Navia’s response, with possible dismissal briefing running through 20 November. This was a procedural order, not a finding of liability or a settlement.
- Update
A federal court consolidated five proposed class actions concerning the breach. A later court order records that eight additional related actions were subsequently consolidated.
- Update
Navia’s Maine filing records written notifications to affected people and a total of 2,697,540 people affected. It lists 12 months of Kroll credit monitoring and identity restoration services.
- Update
HCA reported that Navia had addressed the access flaw in late January and strengthened registration and authentication controls. HCA said Navia found no evidence of fund movements or access to claims or bank account information.
- Made public
Washington’s Health Care Authority publicly announced the breach. Its announcement, updated on 18 March, described a nationwide incident involving 2.7 million records, including current and former state and school employee benefits members.
- Update
Navia says it discovered suspicious activity and began investigating.
- UpdateNothing to patch
Unauthorised access began at Navia Benefit Solutions and continued until 15 January 2026. Navia says personal and health-plan information was accessed and potentially acquired.
Sources
- Notice of Data EventNavia Benefit Solutions
- Navia notifies HCA of security breach affecting PEBB and SEBB membersWashington State Health Care Authority · 2 Mar 2026
- Notification of Navia data breachWashington State Health Care Authority · 3 Mar 2026
- Data Breach Notices: Navia Benefit Solutions, Inc.Maine Attorney General
- Navia discloses data breach impacting 2.7 million peopleBleepingComputer · 19 Mar 2026
- Fisher, et al. v. Navia Benefit Solutions Inc: order regarding amended complaint and responseUS District Court, Western District of Washington, via Justia · 17 July 2026