The Phia Group, LLC, a healthcare cost containment company based in Canton, Massachusetts, disclosed a data breach on October 11, 2025, compromising personal and protected health information (PHI) of individuals. The exposed data includes names, addresses, dates of birth, Social Security numbers, driver’s license numbers, health insurance details, medical records, and financial account information. The breach was reported to the Massachusetts Attorney General’s office, and affected individuals were notified via mail. While the total number of impacted individuals remains undisclosed, the incident poses significant risks, including identity theft, financial fraud, and unauthorized access to sensitive medical data. The company offered free Kroll identity monitoring services to affected parties and advised vigilance in monitoring financial accounts, placing fraud alerts, and obtaining credit reports. Legal firms, such as Shamis & Gentile P.A., are investigating potential class-action lawsuits for compensation due to the exposure of highly sensitive data, particularly Social Security numbers and medical records, which heighten the risk of long-term harm.

Phia Group Data Breach Exposes Sensitive Health and Personal Information of Nearly 25,000 Texas Residents Schubert Jonckheer & Kolbe LLP is investigating a data breach at The Phia Group, LLC, a Massachusetts-based healthcare cost containment and compliance services provider for self-insured health plans and third-party administrators. The incident, discovered on July 9, 2024, involved unauthorized access to Phia Group’s network between July 8 and July 9, 2024, temporarily disrupting operations. Phia Group later confirmed that the breach exposed sensitive data, including names, addresses, Social Security numbers, driver’s license numbers, medical information, and health insurance details. The company reported that 24,903 Texas residents were affected, as disclosed to the Texas Office of the Attorney General. Despite the breach occurring in July 2024, impacted individuals were not notified until January 30, 2026 a delay that may have violated state and federal data breach notification laws. The exposed information heightens risks of identity theft and privacy violations for those affected. Legal investigations are underway to assess potential damages and cybersecurity improvements at Phia Group.