Navia Benefit Solutions breach: FSA, HRA and COBRA participants' information taken over 24 days

What happened in the Navia Benefit Solutions breach?

Navia says it discovered suspicious activity in its environment on January 23, 2026, investigated, and reviewed the data to find out whose information was involved. It says federal law enforcement was notified and that it is reviewing its policies and processes for storing and accessing personal information.

Date	What the letter and the regulators' records say
December 22, 2025	The unauthorized access begins; breach date on the California, Washington and Indiana records
January 15, 2026	The access ends
January 23, 2026	Navia discovers suspicious activity
March 18, 2026	Report submitted to HHS; notice recorded by California and by Washington (City of Bellevue notice); report logged in Massachusetts; Indiana's report gives this as the date notice was sent
March 20, 2026	Posted on the Texas attorney general's list
March 23, 2026	A second Washington notice, 1,100 Washingtonians

The access lasted 24 days before it ended, and Navia found it eight days after that. 54 days passed between the discovery and the first regulator records.

What information was involved?

The filed letter leaves the list of data elements as a blank field, then explains that where a "health plan" appears it means only participation in a health reimbursement arrangement, a flexible spending account or COBRA, and that other details are limited to items such as termination and election dates. It says no claims or financial data were disclosed.

The state records name the rest. Washington lists names, Social Security numbers, full dates of birth, and email addresses with passwords or security question answers; Texas lists names, addresses, Social Security numbers and dates of birth; Massachusetts marks Social Security numbers as breached and medical records, financial accounts, driver's licenses and payment cards as not breached.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	2,151,330
Washington attorney general	Washingtonians (City of Bellevue notice)	319,208
Washington attorney general	Washingtonians (second notice)	1,100
Texas attorney general	Texans	62,821
Massachusetts consumer affairs office	Massachusetts residents	37,498
Indiana attorney general	Indiana residents (no total given)	6,088

The City of Bellevue notice is second only to DriveWealth's in the Washington ranking. The two Washington notices may overlap; the list does not say.

Why did I get a letter from Navia?

The letter links the information to participation in health reimbursement arrangements, flexible spending accounts or COBRA continuation coverage, which people usually get through a current or former employer. Washington's largest Navia notice names one such employer, the City of Bellevue. The guide to letters from companies you never dealt with explains how vendor breaches reach employees.

What is Navia offering people who got a letter?

Navia offers complimentary identity monitoring through Kroll; the number of months is a blank field in the filed copy, so each letter carries its own. Navia says it cannot enroll people on their behalf.

Item	Detail from the letter
Provider	Kroll
Length and deadline	Printed on each letter (blank in the filed copy)
Phone	(844) 443-1645, Monday to Friday, 9:00 a.m. to 6:30 p.m. Eastern Time, excluding some U.S. holidays
Postal address	707 South Grady Way, Suite 350, Renton, WA 98057

What the documents leave open

• How the unauthorized actor got in.
• Which employers' plans are involved, beyond the City of Bellevue named on Washington's list.
• Why Washington lists email addresses with passwords or security answers when the letter does not mention them.

Were passwords exposed in the Navia breach?

Washington's attorney general lists "Email Address and Password/Security Question Answers" among the information for both of Navia's Washington notices. The letter filed with California does not mention passwords. Changing the password on a Navia account, and on any account that shares it, is a reasonable step.