Coalesce, LLC dba BenefitElect Data Breach 2025: 501 PHI Records Exposed After CrushFTP Zero-Day; KillSec Ransomware Group Claims Theft

Arizona-based benefits-administration and HR-software vendor Coalesce, LLC dba BenefitElect disclosed on October 15, 2025 that an unauthorized actor exploited a vulnerability in CrushFTP managed-file-transfer software to access and exfiltrate files from its environment between March 30 and March 31, 2025. BenefitElect detected suspicious activity on April 2, 2025 and engaged external cybersecurity specialists. The HHS Office for Civil Rights breach portal currently reflects 501 individuals under the company’s HIPAA Business Associate filing, recorded as a Hacking/IT Incident at a Network Server. The ransomware-and-extortion group KillSec (also tracked as Kill Security) claimed responsibility on its dark-web leak site and indicated it intended to publish stolen data. The HHS OCR count covers only the HIPAA-covered subset of affected individuals; total notification volume reported to state regulators is broader, and BenefitElect’s review of all affected files remains ongoing.

Timeline of what we know

• March 30 to March 31, 2025 — An unauthorized actor exploits a CrushFTP authentication-bypass vulnerability (later tracked as CVE-2025-31161) and accesses files in BenefitElect’s environment.
• April 2, 2025 — BenefitElect detects suspicious activity, secures its systems, and engages external cybersecurity specialists to investigate.
• April through October 2025 — Forensic review and data analysis determine which files were affected and which individuals had sensitive information involved. Mailing addresses are validated for notification.
• October 15, 2025 — BenefitElect files its HIPAA breach report with HHS OCR (501 individuals, Hacking/IT Incident, Network Server, Business Associate). The same day the company issues a public notice of data event via PR Newswire and submits sample notification letters to the attorneys general of California, Massachusetts, Oregon, and New Hampshire.
• October 16, 2025 — Plaintiffs’ firms publicly announce class-action investigations of Coalesce, LLC dba BenefitElect.

What was exposed

Per BenefitElect’s official security-incident notice, its press release, and the sample notification letter filed with the California Attorney General, the files accessed during the intrusion may have contained any of the following, depending on the individual:

• Full name
• Home address
• Date of birth
• Social Security number
• Financial account information
• Other benefits eligibility and onboarding census information

BenefitElect has stated that not every data element was present for every affected individual, and the specific elements involved are listed on each person’s individual notification letter.

What BenefitElect is offering

BenefitElect is offering affected individuals complimentary credit monitoring and identity-theft protection services through IDX. Enrollment instructions and a unique activation code are included in the individual notification letters. The company has also stood up a dedicated assistance line at 1-833-353-5633, available Monday through Friday, 9 a.m. to 9 p.m. Eastern time, and is directing affected individuals to contact Equifax, Experian, and TransUnion to place fraud alerts or credit freezes.

Class-action and regulatory posture

By mid-October 2025, multiple plaintiffs’ firms — including Federman & Sherwood, Strauss Borrelli PLLC, the Srourian Law Firm (SLFLA), and Maxey Law Firm — had publicly opened investigations into the breach and were signing up potential class members. As of this writing no consolidated class-action complaint against Coalesce, LLC dba BenefitElect has been publicly docketed in federal court; the investigations are pre-suit. The HHS Office for Civil Rights investigation remains open. State attorney general filings have been submitted in California (reference SB24-612847), Massachusetts, Oregon, and New Hampshire.

The CrushFTP vulnerability at the heart of this incident (CVE-2025-31161) was an authentication-bypass flaw disclosed by researchers at Outpost24 in March 2025 and added to CISA’s Known Exploited Vulnerabilities catalog shortly thereafter. KillSec was the first ransomware group to publicly claim exploitation of the bug; the same vulnerability has been linked to attacks on multiple other organizations during the same window.

What to do if you may be affected

Sensitive identifiers including Social Security numbers and financial-account information were exposed. Treat this as a high-severity exposure and stack defenses:

1. Freeze your credit at all three bureaus — Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau online, and blocks new account fraud cold. This is the single highest-leverage step when SSNs are in play.
2. Enroll in the IDX credit monitoring BenefitElect is offering when your notification letter arrives. Use the activation code printed on the letter to register before the enrollment deadline.
3. Watch your bank and brokerage accounts. Financial account information was among the data exposed. Turn on transaction alerts, review statements line by line for the next several months, and report anything unfamiliar immediately.
4. File IRS Form 14039 (Identity Theft Affidavit) if you see a rejected tax return or suspicious IRS correspondence. With SSNs in the wild, tax-refund fraud is a leading follow-on attack pattern.
5. Request an Identity Protection PIN (IP PIN) from the IRS at irs.gov/ippin. It is free and prevents fraudulent filings under your SSN.
6. Be skeptical of phone, text, and email outreach claiming to be from BenefitElect or your employer’s benefits team. Threat actors routinely follow large breaches with targeted phishing that references real benefits or census data. BenefitElect will not ask for your full SSN, bank login, or one-time codes by phone to “verify” your enrollment.
7. Keep the notification letter. It documents the specific data elements involved for your record, which can matter if you later need to file a claim, dispute fraudulent charges, or join a class action.

Sources

• HHS Office for Civil Rights Breach Portal
• BenefitElect — official “Security Incident” notice
• Coalesce, LLC dba BenefitElect — Notice of Data Event (PR Newswire / Fox4KC, October 15, 2025)
• California Attorney General — Submitted Breach Notification Sample (Coalesce/Benefitelect, ref. SB24-612847)
• California Attorney General — Coalesce, LLC dba Benefitelect Notice of Data Event (consumer letter PDF)
• Federman & Sherwood — Coalesce, LLC dba Benefitelect Data Breach (investigation)
• Strauss Borrelli PLLC — BenefitElect Data Breach Investigation
• Kennedys Law — CrushFTP being exploited in widespread cyber attack
• The Record (Recorded Future News) — CISA warns of CrushFTP attacks as ransomware gang makes threats