Paylogix, a New York-based company that manages payroll deductions, employee benefits, and insurance administration for employers across the United States, has disclosed a significant data breach tied to the Akira ransomware gang. Hackers broke into the company’s network in November 2025 and spent nearly a week — between November 13 and November 18 — copying files before the intrusion was discovered. The company has now begun notifying state regulators and the affected individuals, months after Akira added Paylogix to its public leak site in January.
The breadth of stolen data is severe. According to Paylogix’s breach disclosures, attackers made off with Social Security numbers, electronic signatures, financial account information, health insurance details, medical data, passport numbers, and taxpayer IDs. Paylogix has reported more than 64,000 affected residents in South Carolina alone, with thousands more across New Hampshire, Vermont, California, Massachusetts, New Jersey, and other states. Because Paylogix sits at the center of payroll and benefits workflows — handling the most sensitive employee data on behalf of its corporate clients — any organization that uses or has used Paylogix’s services may have employees whose information was exposed. Federal law enforcement has been notified and several law firms have already filed class action lawsuits.