The Vermont Office of the Attorney General reported on February 23, 2023, that Alight Solutions experienced a security incident in November 2022 involving unauthorized access to its corporate email environment, which resulted in the disclosure of personal information including names, social security numbers, and benefit status. The total number of individuals affected is unknown.

The California Office of the Attorney General disclosed a data breach at Alight Solutions LLC, where personal information—including Social Security Numbers (SSNs)—was exposed in emails sent to participants. The incident traces back to September 22, 2014, with additional exposure occurring via URLs containing sensitive data from October 1, 2016. The breach was formally reported on August 20, 2019, following an investigation. The compromised data primarily involved personally identifiable information (PII), raising risks of identity theft and fraud. In response, Alight offered two years of identity theft protection to affected individuals. The delayed discovery and reporting of the breach—spanning nearly five years—heightened concerns over data security protocols and the potential long-term misuse of the exposed information. The incident underscored vulnerabilities in handling sensitive employee or participant data, particularly when transmitted via unsecured channels like email or accessible URLs.