Navia: Data breach affects 2.7 million people

Another serious cybersecurity incident has been added to the long list of data breaches, this time involving Navia Benefit Solutions. The company announced that nearly 2.7 million people were affected by unauthorized access to its systems, with sensitive information exposed to malicious actors.

The case highlights once again the importance of security in organizations that manage personal and financial data on a large scale, especially when these are linked to health services and employee benefits.

Timeline of the attack and delayed detection

According to the data released by the company, the attackers had access to the systems for almost a month, from December 22, 2025 to January 15, 2026. However, the suspicious activity was detected several days later, on January 23, which raises questions about early detection mechanisms.

See also: Iran was preparing cyberattacks before Epic Fury

Following the discovery, Navia immediately activated response procedures and launched an internal investigation, in collaboration with cybersecurity experts, in order to assess the extent of the breach and identify the exact data that was exposed.

What data was leaked?

The investigation revealed that the attacker gained access to critical personal information of users. This included names, dates of birth, social security numbers (SSN), contact information such as phone numbers and emails, as well as health plan membership information.

Specifically, data related to accounts such as FSA (Flexible Spending Accounts), HSA (Health Savings Accounts) and HRA (Health Reimbursement Arrangements), as well as COBRA enrollments, was affected. While the company claims that no financial or claims information was directly exposed, the scope of personal data exposed is considered highly sensitive.

The risks for the victims

Despite the lack of financial data, experts warn that the leaked information is sufficient to organize targeted phishing and social engineering. Attackers can leverage the combined data to create convincing fraud scenarios, increasing the chances of success.

Furthermore, data such as Social Security numbers can be used for identity theft, creation of fake accounts, or even access to other services, especially when adequate multi-factor authentication measures are lacking.

Navia's response and protection measures

Navia announced that it has already reviewed its security and data management policies to strengthen its defenses against future threats. It has also notified the relevant federal authorities and is cooperating with law enforcement authorities to investigate the incident.

See also: Marquis: Ransomware gang stole data of 672,000 people

As a remediation measure, the company is offering affected users free identity protection and credit monitoring for 12 months through Kroll. It also recommends that customers activate fraud alerts and consider freezing their credit files.

No liability – for now

It is noteworthy that so far no known ransomware group has claimed responsibility for the attack. This leaves open multiple scenarios: whether it is a targeted data collection attack without disclosure, or an incident that may develop into a later phase with extortion.

Η απουσία άμεσης ανάληψης ευθύνης δεν μειώνει τη σοβαρότητα του περιστατικού, αλλά αντίθετα εντείνει την αβεβαιότητα γύρω από το ποιος βρίσκεται πίσω από την επίθεση και ποιοι είναι οι τελικοί στόχοι.

See also: Stryker: Iranian hackers used stolen credentials

Another warning for the benefits sector

Navia’s case highlights the growing challenges facing benefit management companies, which collect vast amounts of sensitive data. As cyberattacks become more sophisticated, the need for proactive security, continuous monitoring and rapid response is more imperative than ever.

In an environment where user trust is a critical factor, such incidents can have long-term impacts not only for companies but also for the entire digital services ecosystem.

Source: www.bleepingcomputer.com