What happened
Paylogix, a company that helps employers manage employee benefits, payroll and insurance administration, says it was hit by a cyberattack in which hackers copied files from its network between November 13 and November 18, 2025. The company has filed breach notices with state regulators, notified federal law enforcement, and says it is cooperating with an investigation. The Akira ransomware group later added Paylogix to its leak site in January 2026, though Paylogix has not publicly identified who attacked it. On its leak site the group claims 185 gigabytes of data, including personal information about 130 Paylogix employees; Paylogix has not confirmed either claim.
What the sources say was affected
According to Paylogix’s own notice and breach filings with state regulators, the stolen files included Social Security numbers, financial account information, health insurance information, medical data, passport numbers, taxpayer IDs and electronic signatures. Paylogix has not disclosed the total number of people affected. The three states that published figures add up to 67,789: 64,383 in South Carolina, 2,304 in New Hampshire and 1,102 in Vermont. Paylogix has also filed breach notices in California, Massachusetts, New Jersey and several other states. Several law firms are organizing class action lawsuits over the incident.
Does this touch a small business
It can. Paylogix works as a third-party administrator, sitting inside the payroll and benefits systems of the employers it serves. If your business uses Paylogix, or has used it in the past, your employees’ data may be in the stolen files, even if you never dealt with Paylogix directly beyond setting up benefits administration. Anyone whose employer ran benefits, payroll or insurance administration through Paylogix could be in the affected group, including former employees whose records are still on file.
If you do not use Paylogix and none of your employees do, this incident probably does not touch you directly. If a current or former employee receives a notice letter, take it seriously, even if the name is unfamiliar. The notice will explain what data was involved and what is being offered.
What to do this week
- Ask your HR or payroll lead whether your company uses Paylogix or has used it in recent years, and check whether any notification letter has arrived for you or any current or former employee.
- If you or an employee receives a notice, read it carefully, note the deadline for any free credit monitoring or identity protection offer, and enroll before the window closes.
- Place a fraud alert or a credit freeze with the three credit bureaus, since Social Security numbers were exposed. This is free and can be done online.
- Watch for unexpected mail about medical bills, tax notices or new financial accounts, and report anything suspicious to your bank, your insurer and the FTC at IdentityTheft.gov.
If your small business does use Paylogix, this is a good moment to ask your benefits administrator what they are doing in response and what additional safeguards are in place for the data you share with them. It is also worth reviewing your vendor contracts to confirm what breach notification obligations your providers carry, so you know what to expect and what to demand if something like this happens again.
Sources: The Record, Ransomware.live | Written with AI assistance and checked against these sources on September 25, 2026