Breaches and incidents
Paylogix (New York benefits administrator): ransomware data theft count of 41,739 reported
HIPAA Journal (27 Oct 2026) reports Paylogix told HHS OCR that PHI of 41,739 people was involved.
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- HIPAA Journal (27 Oct 2026) reports Paylogix told HHS OCR that PHI of 41,739 people was involved; an unauthorized third party had network access from 13 to 18 Nov 2025 and files were “accessed and copied”, including dates of birth, SSNs and voluntary benefit information. Update on an older incident: Paylogix filed with the California AG on 14 Aug 2026; the OCR count is the first victim count we found.
- Root cause: not disclosed (Paylogix described a “network disruption”).
- HIPAA Journal says it “appears to have been a ransomware attack by the Akira ransomware group”, which claimed 185 GB; Paylogix itself did not name a group in the reported notice.
- HIPAA Journal says the file review was recently completed; no further response details reported.