Benefitelect Data Breach Exposes Social Security Numbers

On April 2, 2025, Coalesce LLC dba Benefitelect, an Oregon-based benefits administration and HR software provider, discovered suspicious activity within its systems. The company quickly determined that an unauthorized actor exploited a vulnerability in CrushFTP software, allowing files to be accessed and exfiltrated between March 30 and March 31, 2025.

The ransomware group Kill Security later claimed responsibility for the breach, stating on a dark web forum that they had obtained Benefitelect’s database and intended to publish it within a week.

A thorough investigation, aided by third-party cybersecurity specialists, revealed that the compromised files contained sensitive benefits eligibility and onboarding census information including names, addresses, dates of birth, Social Security numbers and financial account information.

For Massachusetts residents, 147 individuals were affected, according to a disclosure filed with the Massachusetts Attorney General. A disclosure was also filed with the California Attorney General.

The combination of PII and financial data significantly increases the risk of identity theft and fraud for those affected. The company publicly acknowledged the incident and provided a detailed security incident notice on its website.

Benefitelect's response

To support those affected, Benefitelect is offering complimentary credit monitoring and identity theft protection services through IDX. Impacted individuals received instructions and an enrollment code to activate these services. Benefitelect is encouraging everyone affected to remain vigilant by monitoring account statements, reviewing credit reports and enrolling in the provided identity protection services.

Given the nature of the breach, a ransomware attack involving the exfiltration of files containing sensitive PII and financial information, affected individuals should consider placing a fraud alert or credit freeze with the major credit bureaus. Regularly reviewing credit reports and promptly reporting any suspicious activity are also recommended steps.