Ransomware Incident at Paylogix Affects 41K Individuals
Data breaches have been announced by Paylogix, the Kenaitze Indian Tribe, the Center for Bone and Joint Surgery of the Palm Beaches, and Wichita Family Dental.
Paylogix, New York
Paylogix LLC, a New York-based third-party administrator and software-as-a-service provider, whose solutions are used for enrollment, billing, and managing voluntary employee benefits, has notified the HHS Office for Civil Rights (OCR) about a breach of the protected health information of 41,739 individuals.
Paylogix explained in its breach notification letter that it experienced a network disruption involving certain computer systems and services. The forensic investigation determined that an unauthorized third party had access to its computer network from November 13, 2025, to November 18, 2025. During that time, files containing personal and protected health information were accessed and copied from its network.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
The review of the affected files was recently completed. Paylogix determined that the exposed data included dates of birth, Social Security numbers, and voluntary benefit information. A subset of individuals also had their access credentials, electronic signatures, financial account information, health insurance information, medical information, passport numbers, taxpayer identification numbers, and/or U.S. alien identification numbers compromised in the incident. While not mentioned in the notification letters, this appears to have been a ransomware attack by the Akira ransomware group, which claimed to have exfiltrated 185 GB of data.
The Kenaitze Indian Tribe, Alaska
The Kenaitze Indian Tribe in Alaska has notified 9,319 individuals about a data security incident that exposed some of their protected health information. Suspicious activity was identified within its network on July 27, 2026. The investigation concluded that an unauthorized third party had access to its network between July 16, 2026, and July 27, 2026. During that time, files on the compromised parts of the network may have been accessed or acquired.
The review of the affected data was recently completed, and it has been confirmed that the exposed data includes first and last names, dates of birth, Social Security numbers, driver’s license numbers/state IDs, financial account numbers, health insurance information, and medical information. The affected individuals started to be notified on September 25, 2026.
Center for Bone and Joint Surgery of the Palm Beaches, Florida
Center for Bone and Joint Surgery of the Palm Beaches in Florida has notified the HHS’ Office for Civil Rights about a breach of the protected health information of 5,461 individuals. On July 27, 2026, suspicious activity was identified on its website. The investigation determined that certain forms on its website may have been compromised, potentially allowing an unauthorized third party to obtain data associated with those forms. While data was exposed, the investigation found no proof that patient data was obtained or misused.
The data review determined that the exposed information included names, contact information, appointment request information, and information voluntarily provided through website forms. The affected forms have been removed from its website, security has been strengthened, and additional security measures have been implemented to reduce the risk of similar incidents in the future.
Wichita Family Dental, Kansas
Wichita Family Dental, a dental practice with locations in Wichita and Derby, Kansas, has identified unauthorized access to an employee’s email account. The unauthorized access was identified on or around May 4, 2026. The account has been secured, and the investigation and review of the account were completed on July 6, 2026.
The account was found to contain the personal and protected health information of 1,273 individuals. The data involved included names, addresses, dates of birth, Social Security numbers, driver’s license numbers/state ID numbers, taxpayer ID numbers, payment card information, financial account information, health insurance information, and dental records. Steps have been taken since the incident to improve email security.
