IT Security Guru is a cybersecurity news portal offering articles, analysis, and insights on cybersecurity threats, vulnerabilities, and best practices. Readers can learn about cybersecurity trends, threat intelligence, and defensive strategies to protect their organizations from cyber attacks and data breaches.

IT Security Guru

Navia Benefit Solutions, a backend workplace benefits administrator serving over 10,000 US employers, suffered a cyberattack that exposed personal data of nearly 2.7 million Americans. Attackers had silent read-only access for three weeks (December 22, 2025 – January 15, 2026), exfiltrating SSNs, dates of birth, phone numbers, email addresses, and health benefits enrollment data (FSA, HRA, COBRA) — some records dating back to 2018. Security experts highlight that read-only access is not low-risk, as it enables systematic data exfiltration without triggering destructive-attack alerts. The incident underscores the hidden exposure risk of backend third-party processors, where individuals have no direct relationship or visibility. Recommendations include treating sensitive data access as high-signal events, alerting on abnormal read patterns, enforcing least privilege, and requiring independent audits and data minimization from vendors. Affected individuals are offered 12 months of identity protection through Kroll.

2.7 million hit in workplace benefits data breach exposing SSNs, dates of birth and health account data