Was It Breached Secria

Recent breaches

Navia data breach: why you got a letter, and what to do

Navia Benefit Solutions handles FSA, HRA and COBRA benefit accounts. Its report to federal health regulators covers 2,151,330 people, as of 1 November 2026.1,2

Return to Kroll
Return address

Date

Navia Benefit Solutions, Inc. ("Navia") writes to make you aware of an event that may affect the security of some of your information.

... health plan refers only to participation in Health Reimbursement Arrangements (HRAs) and Flexible Spending Accounts (FSAs), or Consolidated Omnibus Budget Reconciliation Act (COBRA). ... No claims or financial data were disclosed.

... please call Kroll, our external dedicated assistance line at (844) 443-1645 ... Visit Enroll.krollmonitoring.com/redeem ...

  1. The senderThe letter comes back to Kroll, the firm Navia hired for monitoring and its questions line.2
  2. Why Navia has your dataIts letter ties the health plan data to FSA, HRA and COBRA accounts.2
  3. The questions lineKroll, weekdays 9:00 a.m. to 6:30 p.m. Eastern. You can also write to Navia in Renton, Washington.2
  4. The enrollment siteType it in yourself, with the activation code and verification ID from your letter.2

Drawn from the sample letter Navia filed with California's attorney general. Checked 1 November 2026 against the sources.

The facts, as filed

"The company says" marks Navia's own account. A listing here isn't a finding that the company was at fault.

What happened
The company says it found suspicious activity on 23 January 2026, and that an unauthorized actor accessed and took information between 22 December 2025 and 15 January 2026. It notified federal law enforcement.2
People affected
2,151,330 in Navia's report to the HHS breach portal, filed 18 March 2026 as a business associate, as of 1 November 2026.1 Its Texas filing, published 20 March 2026, counts 62,821 Texans.3 Indiana's attorney general lists 6,088 Indiana residents.4
Washington
Washington's list holds two Navia filings: 319,208 Washingtonians reported on 18 March 2026, and 1,100 on 23 March.5
What leaked
Your name and the data your letter lists. The Texas filing names Social Security numbers, addresses and dates of birth. Washington's larger filing adds email address and password or security question answers.2,3,5
What did not
Health plan data is limited to items such as termination and election dates, and no claims or financial data were disclosed, the company says.2
Lawsuit
As of 1 November 2026 we found no court-approved settlement, and no filed lawsuit we could read in a court record.

Three weeks inside, over the holidays

The dates come from Navia's letter and the government lists.

  1. Unauthorized access begins, the company says.2

  2. The access ends.2

  3. Navia discovers the suspicious activity.2

  4. Report filed with HHS: 2,151,330 people.1

  5. Texas publishes the filing: 62,821 Texans.3

What to do if you got a Navia letter

Match the steps to the data your letter lists. The full checklist covers every data type.

  1. Check the enrollment deadline in your letter.Navia can't enroll you: you have to do it yourself, at the site in the letter, before its deadline.2
  2. Social Security number listed: freeze your credit.Contact each of the three credit bureaus. A freeze is free to place and to lift, and lasts until you remove it.6
  3. Password or security answers listed: change them.Start with your email account, since it controls password resets elsewhere, and turn on multifactor authentication.7
  4. Get an IRS identity protection PIN.The six-digit IP PIN stops someone else filing a tax return with your Social Security number.8

Questions people ask

Is the Navia data breach letter from Kroll real?

The sample Navia filed in California returns to Kroll, names Kroll's line as (844) 443-1645, and gives Navia's address as 707 South Grady Way, Suite 350, Renton, WA 98057.2 Compare yours with it, and with our letter check.

I never signed up with Navia. Why do they have my data?

Navia reported the breach to HHS as a business associate: a company that handles health plan data for someone else.1 Its letter ties the health plan data to FSA, HRA and COBRA accounts. If you had one of those, ask the employer or plan that offered it whether Navia ran it.2

Is there a Navia data breach class action?

We found no court-approved settlement and no filed lawsuit we could read as of 1 November 2026. A real settlement comes with a court-approved notice that names the case. This isn't legal advice.

Sources 8
  1. Breach Portal: HIPAA cases currently under investigation, U.S. Department of Health and Human Services, Office for Civil Rights. Full list exported as CSV. Read 1 November 2026.
  2. Navia Benefit Solutions, Inc.: filing and sample notice (reported 18 March 2026), California Attorney General. Read 1 November 2026.
  3. Data Security Breach Reports, Office of the Texas Attorney General. Navia Benefit Solutions, Inc., published 20 March 2026. Read 1 November 2026.
  4. Data breach year-to-date report, October 2026, Indiana Attorney General. Read 1 November 2026.
  5. Data Breach Notifications, Washington State Office of the Attorney General. Navia filings of 18 and 23 March 2026. Read 1 November 2026.
  6. Credit freeze or fraud alert: Which is right for you?, Federal Trade Commission. Read 1 November 2026.
  7. Did you get an email saying your personal info is for sale on the dark web? (26 September 2022), Federal Trade Commission consumer alert. Read 1 November 2026.
  8. Get an identity protection PIN (IP PIN), Internal Revenue Service. Read 1 November 2026.

Every breach is checked against the company's own notice and a government record, and every source shows the day we read it. How we check