Data Breach - Navia Affects 2.7 Million Individuals

What Happened

Navia Benefit Solutions, Inc. recently disclosed a significant data breach impacting nearly 2.7 million individuals. The breach occurred between December 22, 2025, and January 15, 2026, during which unauthorized actors accessed sensitive data. The suspicious activity was detected by Navia on January 23, prompting an immediate investigation to assess the breach's impact.

The investigation revealed that the hackers accessed and potentially exfiltrated various types of personal information, including names, dates of birth, Social Security Numbers (SSNs), and contact details. Although the breach did not expose financial information or claims data, the nature of the exposed data is concerning, as it can be exploited for phishing and social engineering attacks.

Who's Affected

The breach affects individuals who utilize Navia's services, which include Flexible Spending Accounts (FSA), Health Savings Accounts (HSA), and Health Reimbursement Arrangements (HRA). With over 10,000 employers relying on Navia for benefits administration, the impact is widespread. Individuals who received notifications from Navia are encouraged to take precautions to protect their identities.

Navia has taken steps to notify federal law enforcement about the incident and is working to enhance its security measures. The company has also reviewed its data retention policies to identify vulnerabilities that may have contributed to the breach.

What Data Was Exposed

The investigation confirmed that the following types of sensitive information were compromised:

• Full names
• Dates of birth
• Social Security Numbers (SSN)
• Phone numbers
• Email addresses
• Participation in HRA and FSA programs
• COBRA enrollment information

While no financial data was compromised, the exposed information can still lead to serious risks, such as identity theft and targeted phishing attacks. Navia emphasizes the importance of vigilance for those affected, as threat actors may attempt to exploit this data.

What You Should Do

To mitigate the risks associated with this breach, Navia is offering a 12-month free identity protection and credit monitoring service through Kroll for impacted individuals. This service aims to help monitor any suspicious activity related to their personal information.

Additionally, individuals are advised to consider placing a fraud alert or security freeze on their credit files to prevent unauthorized access. It is crucial for those affected to remain vigilant and monitor their accounts for any unusual activity, as the risk of phishing and social engineering attacks persists following such breaches.