Paylogix data breach: employee benefits enrollment data taken in November 2025

Why did I get a letter from Paylogix?

Paylogix says it likely has your information because its software was used when you enrolled in employee benefits at a current or former employer. It describes itself as a software-as-a-service provider for insurance providers, so the letter can arrive from a company you never chose. The guide to letters from companies you never dealt with explains the chain.

What happened at Paylogix?

Paylogix says it had a network disruption in November 2025, secured its systems and investigated. It then reviewed the files, matched the records to its customers and told those customers on or around July 20, 2026. It reported the event to law enforcement and has added technical security measures.

Date	What the letter and the regulators' records say
November 13 to 18, 2025	Files may have been viewed or taken
July 20, 2026	Paylogix notifies the affected customers
August 14, 2026	Letter date; recorded by California, Washington, Indiana and Massachusetts
September 18, 2026	Report submitted to HHS: 41,739 people

The letters went out nine months after the incident. The letter puts the time down to reviewing the files and matching them to customers.

What information was involved?

The letter fills in each reader's items. The state records give the categories:

Regulator	Information it records
Washington attorney general	Name; Social Security number; financial and banking information; full date of birth; health insurance policy or ID number
Massachusetts consumer affairs office	Social Security numbers and financial accounts marked as breached; medical records, driver's licenses and payment cards not

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	41,739
Washington attorney general	Washingtonians	28,449
Indiana attorney general	Indiana residents (no total given)	15,027
Massachusetts consumer affairs office	Massachusetts residents	6,420

The three state counts alone add up to 49,896, more than HHS's 41,739. The documents do not explain the difference.

What is Paylogix offering?

Twelve months of credit monitoring and identity theft protection from Cyberscout, a TransUnion company. People must enroll themselves within 90 days of the letter.

Item	Detail from the letter
Provider	Cyberscout (TransUnion)
Length	12 months
Enrollment deadline	90 days from the August 14, 2026 letter

What the documents leave open

• Which insurers and employers' plans were involved.
• What caused the network disruption, and how the actor got in.
• The total number of people.