The Phia Group phiagroup.com The Phia Group data breach: what happened and what to do
The Phia Group, a health plan cost-containment company, says someone accessed its network on July 8 and 9, 2024. It began notifying people in January 2026. Data may include names, dates of birth, medical and prescription info, and for some people Social Security numbers.
View all 13,115 breaches- Breach date
- 8 Jul 2024
- Made public
- 28 Jan 2026
- Data exposed
- Names, Physical addresses, Dates of birth, Medical information, Prescription information, Health insurance information, Social security numbers, Driver's licenses, Financial information
- Last updated
What happened
The Phia Group, a Massachusetts company that works for health plans, found suspicious activity in its network in July 2024. Its investigation found the network was accessed without permission on July 8 and 9, 2024. Phia reported it to law enforcement and brought in forensic specialists.
The notices came much later. Phia's public notice appeared in late January 2026, and some of its health plan clients, including Providence Health Plan and AmeriBen, told their own members around the same time that Phia had confirmed their information may have been involved. Phia hasn't published one total for all states.
What was exposed
The data differs by person. Per Phia's notice, it may include names, addresses, dates of birth, medical information, prescription information and health insurance information. For some people it also includes Social Security numbers, driver's license numbers or financial account information.
Health details plus a date of birth are enough for medical identity theft, such as someone using your insurance, and for convincing phone scams from people posing as your plan. A Social Security number adds the risk of new credit being opened in your name.
Phia's response
Phia says it has no indication anyone's information was misused and has added security measures. People with a potentially exposed driver's license, state ID or Social Security number are offered credit monitoring and identity theft recovery through Kroll. A toll-free line, 1-866-408-2595, is listed in the notices.
What to do if you were in it
- 1
Read your notice and use the Kroll offer
If you got a letter, it says which items of yours were involved and how to enroll in the free credit monitoring.
- 2
Freeze your credit at all three bureaus
A freeze stops lenders from opening new accounts in your name. It's free and you can lift it when you need credit. Do it at Equifax, Experian and TransUnion, since each bureau keeps its own file.
- 3
Check your health insurance statements
Read every explanation of benefits you get. Claims for care you didn't receive are the sign of medical identity theft. Report them to your plan.
- 4
Be wary of calls and texts about your plan
Someone who knows your plan, a prescription or your date of birth is not necessarily your insurer. Hang up and call the number on your insurance card.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai. Serus monitors breach databases and the dark web and alerts you when your info shows up. It can't remove data that has already leaked, so the steps here still matter.
Frequently asked
Was I affected by the Phia Group breach?
If The Phia Group or your health plan mailed you a notice in early 2026, your information may have been involved. Your letter lists which items.
What was exposed?
Names, addresses, dates of birth, medical, prescription and health insurance information, and for some people Social Security numbers, driver's license numbers or financial account information.
Why did I hear about it so late?
The breach happened in July 2024. Phia says it confirmed whose data was involved in late 2025 and notified people in January 2026.
Should I freeze my credit?
Yes if your Social Security number or ID number was involved. It's free and you can lift it any time.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
