Decisely Insurance Services Data Breach 2025: 537,603 Affected · Hacking at Cloud/Network Server · Georgia Business Associate

Decisely Insurance Services, LLC — an Alpharetta, Georgia-based employee-benefits brokerage and HR-services firm that handles enrollment, payroll, and benefits administration for small-business clients — disclosed a HIPAA breach affecting 537,603 individuals to the U.S. Department of Health and Human Services Office for Civil Rights on June 13, 2025. Because Decisely processes protected health information on behalf of employer health plans and insurers, the incident is recorded on the OCR portal as a Business Associate breach categorized as a Hacking/IT Incident at a Network Server. According to Decisely’s own substitute notice and California AG filings, the underlying intrusion occurred between December 15 and 17, 2024, when an unauthorized actor accessed and exfiltrated files from Decisely’s cloud storage platform. The company confirmed on May 29, 2025 that the incident involved personal information linked to its partnership with MetLife, among other covered-entity clients. Decisely’s breach response counsel of record, per the Maine AG filing, is Constangy Brooks Smith & Prophete LLP.

Timeline

• December 15-17, 2024 — An unauthorized third party accessed and exfiltrated data from Decisely’s cloud storage platform (date range per California AG filing).
• December 17, 2024 — Decisely detected suspicious activity, engaged external cybersecurity experts, and began an internal investigation.
• June 13, 2025 — Decisely reported the breach to HHS OCR and began mailing individual notification letters. Early state-level filings (Vermont AG, California AG) listed lower totals; the count was updated upward as the investigation continued.
• September 30, 2025 — Supplemental electronic notifications were issued to additional affected individuals, per the Maine AG filing (113,984 total at that stage).
• October 10, 2025 — Edelson Lechtzin LLP publicly announced a class-action investigation; multiple other plaintiff firms opened parallel investigations.
• January 8, 2026 — The New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) issued a public advisory on the Decisely breach, recommending affected individuals review guidance on compromised PII and identity theft.

The 537,603 figure on the HHS OCR portal is the consolidated total after multiple supplemental notifications. State AG offices across at least 14 states received filings: Texas (59,740 residents), Vermont (65,405), Maine (113,984), New Hampshire (2,255), Washington (2,861), Massachusetts (682), Montana (284), California, Iowa, Nebraska, Oregon, Rhode Island, and South Carolina.

What was exposed

Per Decisely’s substitute notice and state attorney-general filings, the data acquired varies by individual and may include any combination of:

• Full name and home address
• Date of birth
• Social Security number
• Driver’s license number
• Passport number
• Digital signature
• Financial account information
• Health insurance information, claims information, and patient ID
• Diagnosis or condition information, treatment information, and provider name

The combination of Social Security number, financial account information, and health/claims data places this incident at the high end of the identity-theft and medical-identity-theft risk spectrum.

Who’s notifying you (business associate)

Decisely is a business associate under HIPAA. It does not provide medical care directly. It administers benefits and processes claims on behalf of employer-sponsored health plans, insurance carriers (the substitute notice references its relationship with MetLife, employers, and benefit-plan providers), and other covered entities. That means your individual notification letter may arrive from Decisely directly, or it may arrive from the employer or health plan whose data Decisely was handling. Either way, the underlying incident is the same one filed with HHS OCR on June 13, 2025.

Decisely is offering complimentary Kroll identity-monitoring and managed identity-theft recovery services to individuals whose Social Security numbers were involved. A dedicated call center is listed in the notice at 866-461-3640 (8:00 a.m.–5:30 p.m. Central).

Class-action posture

Multiple federal class-action complaints were filed in the U.S. District Court for the Northern District of Georgia. The court subsequently consolidated the first three actions into a single lead case:

• Smith v. Decisely Insurance Services, LLC — 1:25-CV-03461-ELR (lead case)
• Garcia v. Decisely Insurance Services, LLC — 1:25-CV-03466-ELR (consolidated into Smith)
• Morris v. Decisely Insurance Services, LLC — 1:25-CV-03489-ELR (consolidated into Smith)
• Warren v. Decisely Insurance Services, LLC — 1:25-cv-04295 (N.D. Ga., status pending)

Per court records, the consolidation motion was granted unopposed, with Smith as the lead case and interim class counsel appointed. The Related Actions were administratively closed; all further filings proceed under No. 1:25-CV-03461-ELR. Additional plaintiff firms continue to investigate: Federman & Sherwood, Edelson Lechtzin LLP, Migliaccio & Rathod LLP, Strauss Borrelli PLLC, Cole & Van Note, Pittman Dutton Hellums Bradley & Mann, Murphy Law Firm, and Lynch Carpenter LLP.

What to do

• Freeze your credit with all three nationwide consumer reporting agencies. This is the single highest-leverage step against new-account identity theft and remains free.
• Enroll in the Kroll monitoring Decisely is offering if your notification letter includes an activation code. It is paid for by Decisely and does not require waiving any legal rights.
• Watch your health-insurance EOBs and provider statements for unfamiliar claims. Medical-identity theft does not show up on a credit report.
• If your passport number was involved, you can request a replacement passport through the State Department; passport-number misuse is harder to monitor than SSN misuse.
• Keep the notification letter. With four federal class-action complaints already on file, the letter is your proof of standing to participate in any eventual recovery.
• Stop the ongoing flow of your health data. HealthConsent files HIPAA restriction requests so the health insurance, claims, and diagnosis information exposed in this breach is not continuously re-shared across employer benefit platforms, clearinghouses, and downstream insurers.

Sources

• Decisely — Notice of Data Security Incident (PDF) — the entity’s own substitute notice.
• HIPAA Journal — Data Breaches Announced By Decisely Insurance Services & Apex Global Solutions — trade-press coverage including the updated 537,603 count.
• Maine Attorney General — Decisely data breach notice — state regulator filing.
• Vermont Attorney General — Decisely Insurance Services data breach notice (June 13, 2025) — state regulator filing (65,405 Vermont residents).
• ClassAction.org — Decisely Insurance Services Data Breach Lawsuit Investigation — plaintiff-side investigation summary.
• CourtListener — Garcia v. Decisely Insurance Services, LLC (1:25-cv-03466, N.D. Ga.) — filed federal class-action complaint.
• Justia — Smith v. Decisely Insurance Services, LLC (1:2025cv03461, N.D. Ga.) — filed federal class-action complaint.
• GlobeNewswire — Lynch Carpenter Investigates Claims in Decisely Insurance Services Data Breach (June 25, 2025) — firm investigation announcement.
• GlobeNewswire — Edelson Lechtzin LLP investigating Decisely claims (Oct 10, 2025) — firm announcement establishing class-action posture.
• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.