Navia Benefit Solutions naviabenefits.com Navia data breach 2026: what happened and what to do
Navia Benefit Solutions reported that attackers accessed its systems from December 22, 2025 to January 15, 2026. About 2.7 million people were affected. Exposed data included names, dates of birth, Social Security numbers, phone numbers and email addresses.
View all 13,177 breaches- Breach date
- 22 Dec 2025
- Made public
- 13 Mar 2026
- Affected
- 2,697,540
- Data exposed
- Names, Dates of birth, Social security numbers, Phone numbers, Email addresses, Health benefits enrollment information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Navia Benefit Solutions administers benefits such as health reimbursement accounts, flexible spending accounts and COBRA. According to its filing with the Maine Attorney General, reported by SecurityWeek and HIPAA Journal, someone accessed its systems between December 22, 2025 and January 15, 2026. Navia noticed suspicious activity on January 23, 2026.
A notice went up on Navia's website on March 13, 2026, and letters began going out on March 18. The filing counts 2,697,540 people.
Sources checked: securityweek.com, hipaajournal.com, securityaffairs.com
Last verified against the official page:
What was exposed
The reported data includes names, dates of birth, Social Security numbers, phone numbers and email addresses, plus whether a person took part in a health reimbursement arrangement, flexible spending account or COBRA. Navia said no claims data or financial account information was disclosed.
Navia runs COBRA for other employers, so you may have been notified even if you never dealt with Navia directly. Your employer or a former employer may be the connection.
What it means
A Social Security number together with a date of birth is what criminals need to open credit in your name, and it stays useful for years. Phone numbers and emails feed phishing that mentions your benefits.
Navia offered affected people 12 months of free credit monitoring and identity theft protection.
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion. The FTC explains how.
- 2
Take the free credit monitoring
Use the code in your letter. It alerts you to new activity, so pair it with a freeze.
- 3
Check your benefits statements
Look at explanation of benefits statements and account activity for anything you didn't do.
- 4
Expect phishing about your benefits
Be wary of emails, texts and calls about COBRA, FSA or HRA accounts. Go to the provider's site yourself instead of using links.
- 5
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
Official filings
- U.S. Department of Health and Human Services , filed 18 Mar 2026 : 2,151,330 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Navia breach?
Navia mailed letters starting March 18, 2026. If you had an HRA, FSA or COBRA account administered by Navia, check your mail and your employer's benefits team.
What was exposed?
Names, dates of birth, Social Security numbers, phone numbers, email addresses and benefit plan participation. Navia said claims data and financial account information were not disclosed.
Should I freeze my credit?
Yes, because Social Security numbers and dates of birth were included. A freeze is free.
Sources
- securityweek.com/navia-data-breach-impacts-2-7-million/
- hipaajournal.com/navia-benefit-solutions-data-breach/
- securityaffairs.com/189726/data-breach/navia-data-breach-impacts-nearly-2-7-million-people.html
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
