Navia Profit Options, Inc. (Navia) is informing practically 2.7 million people of a knowledge breach that uncovered their delicate data to attackers.
An investigation into the incident revealed that the hackers had entry to the group’s methods between December 22, 2025, and January 15, 2026. Nonetheless, the corporate found the suspicious exercise on January 23.
Navia says that it responded instantly and launched an inquiry to find out the potential influence of the incident.
“The investigation decided that an unauthorized actor accessed and purchased sure data between December 22, 2025, and January 15, 2026,” the corporate says within the notification to impacted people.
Navia is a consumer-focused administrator of advantages that gives providers to greater than 10,000 employers throughout the U.S.
The corporate gives software program and buyer providers for the administration of Versatile Spending Accounts (FSA), Well being Financial savings Accounts (HSA), Well being Reimbursement Preparations (HRA), Commuter Advantages and COBRA Providers.
It additionally helps deal with commuter advantages, way of life accounts, schooling advantages, compliance/threat providers, and retirement-related choices.
In accordance with the corporate, the investigation into the breach revealed that the hacker accessed and will have exfiltrated the next varieties of information:
- Full identify
- Date of beginning
- Social Safety Quantity (SSN)
- Cellphone quantity
- E-mail tackle
- Participation in HRA (Well being Reimbursement Preparations)
- FSA (Versatile Spending Accounts) data
- Consolidated Omnibus Funds Reconciliation Act (COBRA) enrollment data
Navia underlines that the info breach didn’t expose particulars about claims or monetary data. Nonetheless, the uncovered information is sufficient for menace actors to deploy phishing and social engineering assaults aimed toward affected people.
The corporate states that it has reviewed its safety posture and information retention insurance policies to determine potential weaknesses that may be improved, and has notified federal regulation enforcement in regards to the incident.
Clients whose data was uncovered will likely be lined by a free 12-month id safety and credit score monitoring service from Kroll. Letter recipients are additionally inspired to contemplate putting a fraud alert and safety freeze on their credit score information.
On the time of writing, no ransomware group has claimed the Navia information breach.
Malware is getting smarter. The Pink Report 2026 reveals how new threats use math to detect sandboxes and conceal in plain sight.
Obtain our evaluation of 1.1 million malicious samples to uncover the highest 10 strategies and see in case your safety stack is blinded.
