Worker Benefits Administrator Notifying 2.7M of Hack

A Washington-state employee benefits administrator is notifying nearly 2.7 million individuals that their data, including health plan and personal information such as Social Security numbers, was potentially stolen in a hacking incident discovered in January.

See Also: Using the Netskope HIPAA Mapping Guide

Navia Benefit Solutions, headquartered in Renton, Wash., on Wednesday reported the data breach as affecting 2.69 million people.

Navia on its website said it provides employee benefits administration, including for COBRA and Health Care Flexible Spending Accounts, to over 10,000 clients and more than 1 million participants. The 2.7 million people affected by the incident likely also include former participants and dependents.

Navia did not immediately respond to Information Security Media Group’s request for additional details about the hacking incident, including the number of clients affected.

The Washington State Health Care Authority, which manages Medicaid and other health insurance coverage in that state, is among Navia clients that have publicly disclosed being affected by the hack.

The state agency said that some Navia benefits records compromised in the hack dated back to 2018 and affected about 35,600 public employees and retirees. Also, 37 Washington state school districts that contracted with Navia before January 2020 were affected.

In its breach notice, Navia said that on Jan. 23, the company discovered suspicious activity related to its IT environment. The investigation into the incident determined that an unauthorized actor accessed and potentially acquired certain information during a three week period, between Dec. 22, 2025, and Jan. 15, 2026.

The information potentially compromised in the hack includes name, date of birth, Social Security number, phone number, email address and health plan information of affected individuals.

‘One-Stop Shop’

Employee benefits administrators are an attractive hacking target for several reasons, said Mike Hamilton, CTO of Pisces International, a cyber education provider to the public sector and former CISO of the state of Washington.

“This is a ‘one-stop shop’, in compromising a healthcare service provider,” he said. “In this case, the records combine health and finance information,” he said.

Navia is hardly the first employee benefits administrator to report a hacking incident affecting scores of individuals. Utah-based administrator HealthEquity in 2024 reported to federal regulators a hacking incident affecting 4.3 million individuals involving compromised credentials used by a third-party vendor (see: Health Benefits Administrator Reports 3rd Party Hack to SEC).

Although Navia has not disclosed details, Hamilton suspects that credentials were compromised and multifactor authentication defeated through session token stripping, or that a help desk was socially engineered to perform a password and MFA reset.

“The most prevalent tactics for gaining initial access to a network are vulnerability exploit, social engineering, and credential abuse and each of these vectors is difficult to defend,” he said.

Hamilton recommends that covered entities vet their benefit administrators. “Focus on requirements for user training, processes for help desk credential management, rapid patching for assets exposed to the Internet, and monitoring to ensure that impact from a cyber event may be detected early and minimized,” he said.

As of Thursday, several law firms had issued public statements saying they are investigating the Navia breach for potential class action litigation.