Paylogix data breach exposes confidential information after Akira attack

Paylogix, an employee benefits and insurance administration provider, disclosed a major data security incident that occurred last year, in which threat actors gained access to its internal network and exfiltrated sensitive information.

 

Headquartered in Westbury, New York, Paylogix is an employee benefits administration and insurance technology services provider. The company supports employers, insurance carriers, and benefits professionals with platforms and services for managing voluntary benefits and related administrative processes.

 

In a data security notice Paylogix said that it detected an unauthorised intrusion into its network. The company promptly initiated an investigation, supported by external cyber security specialists, to assess the nature and extent of the breach.

 

It also took steps to secure the affected systems, contained the disruption and notified relevant law enforcement authorities about the incident.

 

“Through the investigation, Paylogix determined that certain systems were subject to unauthorised access and certain files were copied from the Paylogix network between November 13, 2025 and November 18, 2025 as part of a cyber event,” Paylogix said.

 

The compromised data included names, dates of birth, Social Security numbers, voluntary benefit information, access credentials, electronic signatures, financial account information, health insurance information, medical information, passport numbers, taxpayer identification numbers, and US alien identification numbers.

 

While the final number of affected individuals has not yet been confirmed, Paylogix reported to state regulators that the breach impacted approximately 64,383 individuals in South Carolina, 2,304 in New Hampshire, and 1,102 in Vermont. The company also submitted breach notifications to regulators in California, Massachusetts, New Jersey, and several other states.

 

Paylogix has urged affected individuals to remain vigilant by regularly reviewing their credit reports, account and benefits statements, and to report any suspicious activity to law enforcement agencies, including local police and the state attorney general.

 

 

In January, the Akira ransomware group claimed responsibility for the cyber attack on Paylogix listing the company as a victim on its data leak site.The group claimed to have obtained confidential company data and threatened to release it publicly unless its ransom demands were met.