Late 2025–January 2026 forensics from Navia Benefit Solutions—a COBRA, HRA, FSA, and related administrator used by employers including Branch Metrics—documented unauthorized access from December 22, 2025 through January 15, 2026, with substitute notices uploaded around March 13, 2026 and mailings following on March 18. Trade and HIPAA-oriented reporting tied Navia’s Maine filing to roughly 2.7 million people across Navia’s entire client footprint, while Branch and other employers issued parallel letters describing SSN, demographic, contact, and tax-advantaged health-plan program fields for their own workforces.
Canonical record: Branch / Navia 2026 on BreachHistory.
Sources: SecurityWeek, HIPAA Journal