Paylogix breach: hackers copied health data of 41,739 people
Paylogix, a SaaS provider for voluntary employee benefits, told HHS that intruders accessed its network from November 13 to November 18, 2025, and copied files with protected health information of 41,739 people. The file review is complete; exposed data includes dates of birth, Social Security numbers and, for some individuals, financial and medical data. HIPAA Journal assesses the incident as an Akira ransomware attack, which the company has not confirmed. Affected individuals should watch for Paylogix communications.
What happened
Paylogix, a New York-based SaaS provider for voluntary employee benefits, told HHS that intruders had access to its network from November 13 to November 18, 2025. Files with personal and protected health information of 41,739 people were accessed and copied. The review of affected files has been completed.
Why it matters
Exposed data includes dates of birth, Social Security numbers and benefit information; a subset of individuals also had credentials, financial account data, health insurance and medical information compromised, according to the notification. Affected people face financial fraud and identity theft risk. Companies using Paylogix as their benefits administrator may have employee data involved.
What to do
Check whether the company uses Paylogix and whether employee data is in scope. Direct affected individuals to follow Paylogix communications and monitor financial accounts and credit. Review contractual and notification obligations with the vendor.
For the technical team
- Affected
- Paylogix (New York Paylogix LLC) Rede interna da Paylogix, fornecedora de SaaS para inscrição, cobrança e gestão de benefícios voluntários de funcionário · Paylogix internal network (New York Paylogix LLC), SaaS for enrollment, billing and management of voluntary employee benefits. No affected software product or version was cited.
- Exploitation
- Completed intrusion with file access and copying, reported by Paylogix itself to HHS OCR. HIPAA Journal attributes the case to the Akira ransomware group; the assessment is unconfirmed by the company and absent from the notification letters. No CVE or PoC involved.
- Fix
- Not applicable: data breach incident, no software fix cited in the sources.
- Vector
- Unauthorized third-party access to the internal network from November 13 to November 18, 2025, with disruption involving certain computer systems and services. The initial entry vector was not described in the notification. HIPAA Journal assesses the case as a ransomware attack.
- More details
- Exposed data per Paylogix: dates of birth, Social Security numbers and voluntary benefit information; a subset of individuals also had access credentials, electronic signatures, financial account information, health insurance information, medical information, passport numbers, taxpayer identification numbers and/or U.S. alien identification numbers compromised. The forensic investigation determined the access window and the file review was recently completed.
Timeline
Paylogix notifies HHS of an incident with access to and copying of data on 41,739 individuals.
Sources 1 source
- Ransomware Incident at Paylogix Affects 41K Individuals HIPAA Journal
