E-Benefit Solution has sent breach notification letters explaining that its network environment was accessed without authorization, with the company identifying the intrusion after breach dates of April 22, 2024 and July 11, 2024. According to the letter, an outside party got into the company’s systems and removed certain files before the incident was contained. E-Benefit says it worked with outside cybersecurity specialists to investigate, secured its network, and reported the matter to law enforcement. It wasn’t until December 10, 2024, after a lengthy review of the affected files, that the company determined personal information belonging to specific individuals may have been included in what was taken.
The version of this letter available to us doesn’t spell out an exact number of people affected, and it’s addressed to a specific recipient rather than the public at large. What we do know is that the letter confirms full names were part of the exposed files, and the surrounding language — including a section devoted to protecting your medical information and an offer of identity monitoring — suggests other, more sensitive details may have been involved as well. If your own copy of the letter lists additional data types, those specifics should take priority over anything general said here.
What exactly did E-Benefit say was taken from its files?
- Full name
- The letter references possible exposure of broader personal and/or health information, though the complete list of data elements was not fully legible in the copy of the notice we reviewed
- If you received a physical copy of this letter, check the section describing ‘What Information Was Involved’ for the specific details tied to your own record
To help reduce the risk of misuse, E-Benefit is offering a complimentary membership through IDX, A ZeroFox Company, which includes credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and hands-on identity theft recovery assistance if you ever need it. The letter directs recipients to scan a QR code or visit an enrollment website using a personal enrollment code printed at the top of their individual letter — details that are unique to each recipient and weren’t included in the general template text we had access to, so you’ll want to check your own physical letter for that code and web address.
Steps worth taking if your information was in these files
- Activate the free IDX membership using the enrollment code from your letter — monitoring only works once it’s turned on
- Place a fraud alert with one of the three credit bureaus (Equifax, Experian, or TransUnion); one call triggers alerts at all three
- Consider a full security freeze on your credit files if you want the strongest protection against new accounts being opened in your name
- Pull your free annual credit reports at annualcreditreport.com and look for accounts or inquiries you don’t recognize
- Because the letter also raises the possibility of health information exposure, review any explanation of benefits statements from your insurer and follow up on services you didn’t receive
- For ongoing peace of mind, consider signing up for a service like Aura or LifeLock, which can alert you if your personal information turns up somewhere it shouldn’t
- Keep the letter itself — you may need the details in it if you ever have to dispute fraudulent activity or file a police report
The version of this notice we reviewed did not include a working phone number or a specific legal citation for the notification requirement, so we can’t confirm those details here — refer to your own copy of the letter for E-Benefit’s contact line and any state-specific requirement it cites.