Loading story…
Paylogix, a technology provider for voluntary benefits administration, disclosed a cyber incident that disrupted its network and led to unauthorized access to certain systems between November 13 and November 18, 2025. After containment and restoration efforts, the company said its investigation found that files on the network may have been viewed or taken, exposing sensitive information tied to customer records.
The compromised data may include names, addresses, email addresses, policy numbers, and Social Security numbers. Paylogix said it completed a review of affected files, notified relevant customers around July 20, 2026, and issued individual notices dated August 14, 2026; one state filing said about 634 Rhode Island residents may have been affected. The company reported the incident to law enforcement, implemented additional technical security measures, and is offering 12 months of credit monitoring and identity theft protection through Cyberscout, a TransUnion company.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Paylogix's breach notification letter was dated August 14, 2026, informing recipients their information was found in affected files. The notice offered 12 months of complimentary credit monitoring and identity theft protection through Cyberscout and stated that about 634 Rhode Island residents may have been impacted.
After reviewing affected files and reconciling impacted records, Paylogix notified relevant customers about the incident on or around July 20, 2026. The company had also reported the event to law enforcement and said notification was not delayed by law enforcement.
Paylogix stated that the period during which certain files may have been viewed or taken from its network lasted through November 18, 2025. The incident response included containment and restoration of impacted systems and services.
Paylogix experienced a cyber incident that caused network disruption and unauthorized access to certain computer systems and services. The company later determined that files may have been viewed or taken during this period.
The Akira ransomware operation added Paylogix to its leak site, claiming the company as a victim. Paylogix did not publicly identify the responsible attackers, so the listing is an unconfirmed ransomware-group claim rather than an official attribution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcecyber.nj.gov
Open sourceconsumer.sc.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Artisans’ Bank disclosed a data security incident after detecting suspicious activity in an employee email account on March 20, 2024 and determining that an unauthorized actor had access to a limited number of employee mailboxes between January 24 and March 20, 2024. The bank said the exposed information varied by individual and may have included names and other personal data found in affected emails and files; by May 30, 2024, it concluded that some individuals’ information was potentially accessed or acquired. Artisans’ Bank said it secured its email tenant, reviewed relevant content to identify affected people, and offered **24 months** of complimentary Experian IdentityWorks credit monitoring and identity restoration services, while stating it had no indication of identity theft or fraud tied to the incident at the time of notice. Harvard Pilgrim Health Care separately disclosed a ransomware-related breach affecting systems used to service members, accounts, brokers, and providers after discovering the incident on April 17, 2023. The insurer said an unauthorized party copied data from its systems between March 28 and April 17, 2023, and later determined by August 18, 2024 that the affected files may have contained personal information and protected health information. Harvard Pilgrim said it took systems offline, notified law enforcement and regulators, engaged third-party cybersecurity experts, implemented additional safeguards, and offered **two years** of IDX credit monitoring and identity protection services; it also said it was not aware of misuse of the impacted information when the notice was issued.
Jun 29, 2026
Kelly & Associates Insurance Group, Inc. (**Kelly Benefits**) disclosed that an unauthorized party accessed its environment between **December 12 and December 17, 2024** and copied certain files from its systems. The company said it engaged third-party forensic specialists to investigate, completed its review of the affected files on **March 3, 2025**, and determined that the compromised data included individuals’ names along with additional, unspecified data elements. Kelly Benefits also reported the incident to the **FBI** and said it notified affected data owners and impacted individuals. The breach notices say Kelly Benefits is offering complimentary **IDX** credit monitoring and identity protection services to affected people, with enrollment available until **September 30, 2025**. The company’s notices also direct recipients to consider fraud alerts, credit freezes, and ongoing credit report monitoring, and one state filing indicated that about **14 Rhode Island residents** were affected.
Jun 29, 2026
Multiple healthcare organizations and vendors reported **delayed patient notifications** after discovering unauthorized access to protected health information (PHI), in some cases more than a year after the underlying compromise. In Colorado, **Alpine Ear, Nose, and Throat (Alpine ENT)** notified **65,648** individuals that an attacker accessed and exfiltrated files containing PHI in an incident identified on **Nov. 19, 2024**; the **BianLian** ransomware group later claimed responsibility and posted the organization to its leak site. Exposed data was described as highly sensitive, including medical information and, for some individuals, **financial account data and payment card details** (including CVC/expiration) and **Social Security numbers**; Alpine ENT reported no confirmed identity theft at the time of notification and offered credit monitoring. Separately, **Bayada Home Health Care** disclosed exposure risk tied to a **third-party vendor (Doctor Alliance)** after Doctor Alliance reported unauthorized network access during **Oct.–Nov. 2025**, potentially affecting Home Health Certification and Plan of Care forms containing patient identifiers and clinical/insurance details (and **SSNs for a subset**). Bayada said it discontinued using Doctor Alliance and reported the matter to regulators. In another vendor-related incident, **TriZetto Provider Solutions (Cognizant)**—an insurance verification provider—suffered a cyberattack impacting PHI across multiple states; Oregon providers began notifying additional patients after the breach was reported as occurring in **Nov. 2024** but not discovered until **Oct. 2, 2025**, with no financial data reportedly compromised and no evidence of misuse so far; the incident has prompted **class-action lawsuits**, engagement of **Mandiant**, and law enforcement notification.
Jun 29, 2026