Navia Reports Data Breach Affecting Nearly 2.7 Million People
Summary
Navia says an unauthorized actor accessed its systems from December 22, 2025, to January 15, 2026, and acquired certain information. Nearly 2.7 million people were notified; the company is offering 12 months of identity protection and credit monitoring.
Key points
- Navia says an unauthorized actor accessed its systems between December 22, 2025, and January 15, 2026; the company discovered suspicious activity on January 23.
- Nearly 2.7 million people were notified of the breach.
- Potentially affected information includes names, dates of birth, Social Security numbers, phone numbers, email addresses, and HRA, FSA, and COBRA enrollment details.
- Navia says claims and financial information were not exposed; the exposed data could be used in phishing or social engineering.
- Navia notified federal law enforcement and says it reviewed its security posture and data retention policies.
- Affected individuals are being offered 12 months of identity protection and credit monitoring through Kroll; Navia recommends considering a fraud alert or credit freeze.
- No ransomware group had claimed responsibility at the time of writing.
Article Details
- Victim Organization
- Navia Benefit Solutions, Inc.
- Incident Type
- Unauthorized access to systems and acquisition of personal and benefits enrollment information; possible exfiltration.
- Incident Date
- 2025-12-22
- Data Types Exposed
- Full names
- Dates of birth
- Social Security numbers
- Phone numbers
- Email addresses
- HRA participation information
- FSA information
- COBRA enrollment information
- Affected Records
- Nearly 2.7 million individuals were notified.
- Operational Impact
- Navia investigated the incident, notified federal law enforcement, reviewed its security posture and data retention policies, and is offering affected individuals 12 months of identity protection and credit monitoring through Kroll. The article does not report operational disruption. Navia said claims and financial information were not exposed.
- Ransom Or Extortion
- No ransomware group had claimed the breach at the time of writing; no ransom demand or extortion was reported.
- Claim Status
- confirmed