STRATeBEN, an employee benefits consulting company based in Bethesda, Maryland, experienced a data breach following unauthorized access to an employee's Microsoft 365 account. This unauthorized access occurred between August 14 and November 9, 2025. The company discovered the breach on December 3, 2025, and confirmed on March 18, 2026, that data had been exposed. Notifications to affected individuals began on March 18 or March 26, 2026.
The confirmed data types exposed include full names, Social Security Numbers (SSN), and dates of birth. Some sources suggest addresses, government IDs, medical information, and financial information may also have been involved, but these are not fully confirmed. At least two individuals in Vermont and four in Massachusetts were affected. The total number of affected individuals across all states has not been publicly disclosed.
Details about the full scope of this incident, including the total number of individuals affected, may emerge later as investigations continue. Notices to all affected individuals may also be delayed.