Clarity Benefit Solutions Breach: HSA Platform Hack Exposes Account Data

Clarity Benefit Solutions, a benefits administration platform provider, disclosed a breach of its HSA (Health Savings Account) system after discovering unauthorized access to a "small number of accounts" on August 27, 2025. The Maine Attorney General filing reports 64 affected individuals, with exposed data including names and HSA account numbers. The filing was submitted October 24, 2025, roughly 58 days after discovery -- fast by industry standards.

The breach is small in scale but significant in structure. Clarity operates as a third-party benefits administrator, meaning the 64 affected individuals aren't Clarity's direct customers -- they're employees of companies that use Clarity to manage HSA, FSA, and other pre-tax benefit accounts. The filing identifies at least one "data owner," Apis Services, Inc., whose employees were notified on behalf of Clarity. This third-party chain creates the layered vendor risk dynamic that financial services regulators have been increasingly focused on.

What Happened

On August 27, 2025, Clarity identified suspicious activity within its benefits platform. The company engaged a third-party cybersecurity forensic specialist to investigate. By September 18, 2025 -- 22 days later -- the investigation confirmed that an unauthorized party had accessed a small number of accounts. Clarity completed its review of affected data by September 23, 2025, and began notifying data owners on September 26, 2025.

The notification describes this as unauthorized access to the benefits platform itself, not an email compromise or network intrusion. This suggests the attacker gained access to user accounts within Clarity's web application -- either through stolen credentials, a platform vulnerability, or a misconfigured access control.

For a benefits platform that stores HSA account information, the distinction matters. HSA platforms authenticate individual accountholders who check balances, submit claims, and manage investments. A compromise of individual accounts within the platform points to credential-level rather than infrastructure-level exposure, which typically limits the blast radius -- consistent with the low number of affected individuals.

The HSA Account Number Problem

The exposed data -- names and HSA account numbers -- presents a specific financial risk. HSA accounts are tax-advantaged savings vehicles used for qualified medical expenses, and they function much like bank accounts. HSA account numbers can be used to:

• Initiate fraudulent distributions -- withdrawing funds from the HSA by impersonating the accountholder
• Set up unauthorized direct deposits -- redirecting employer or individual contributions
• File fraudulent tax returns -- HSA contribution data is reported on IRS Form 8889

Unlike credit card numbers, HSA account numbers don't change frequently and are rarely monitored in real time. Most HSA holders check their accounts infrequently, making unauthorized activity harder to detect quickly. The combination of low monitoring and direct financial access makes HSA account exposure a higher-risk event than the small number of affected individuals might suggest.

Third-Party Benefits Platform Risk

Clarity's position in the data supply chain is the more consequential story. Benefits administration is a sector where a single platform provider handles sensitive financial and health data for employees across dozens or hundreds of corporate clients. When Clarity's platform was breached, the exposure cascaded to workers at companies like Apis Services who had no direct relationship with Clarity and no control over its security posture.

This is the same third-party risk dynamic seen in larger-scale financial sector incidents. The Velocity Risk Underwriters breach, filed with the Maine AG in September 2025, also involved third-party exposure -- in that case affecting 39,310 individuals through a vendor relationship. And the Cove Risk Services incident, disclosed in December 2025 with 49,385 affected individuals, traced to unauthorized access at an insurance intermediary.

The pattern is consistent: organizations that serve as aggregation points for personal financial data -- benefits administrators, claims processors, insurance intermediaries -- represent concentrated risk targets. A single successful intrusion exposes data belonging to multiple client organizations and their employees.

Regulatory Implications for Benefits Platforms

Benefits administrators handling HSA accounts operate at the intersection of financial services and healthcare regulation:

• ERISA (Employee Retirement Income Security Act) imposes fiduciary duties on plan administrators, including safeguarding plan assets and participant information
• The GLBA Safeguards Rule applies to financial institutions, and HSA custodians may fall within scope depending on their charter
• HIPAA potentially applies if Clarity handles protected health information in connection with health plan administration
• State breach notification laws apply in every jurisdiction where affected individuals reside -- here, Maine's statute triggered the AG filing

For the corporate clients whose employees were affected, this breach triggers vendor risk management review obligations. Most financial institutions subject to FFIEC examination guidance are required to maintain ongoing oversight of third-party service providers, including periodic security assessments and contractual breach notification requirements.

The 58-day notification timeline from discovery to AG filing is notably faster than many comparable incidents. FinSecLedger's breach tracker shows notification delays ranging from under 60 days to over 275 days across recent financial sector breaches, with the average trending well above 90 days. Clarity's relative speed may reflect the limited scope of the breach and the straightforward nature of the data review.

What Employers Using Third-Party Benefits Platforms Should Do

1. Require SOC 2 Type II reports from your benefits administrator. SOC 2 audits validate that the platform's security controls are operating effectively over time -- not just designed on paper. Annual attestation is the baseline; continuous compliance monitoring is better.

2. Contractually mandate breach notification timelines. Your vendor agreement should specify notification within 48-72 hours of breach confirmation, not whenever the vendor gets around to it. Include data owner notification rights and audit provisions.

3. Enable MFA on all employee-facing benefit portals. If your benefits administrator offers multi-factor authentication for employee accounts, make it mandatory. If they don't offer it, that's a red flag.

4. Monitor HSA accounts for unauthorized transactions. Employees should review their HSA statements monthly -- the same way they check bank and credit card activity. Many HSA custodians offer transaction alerts that can be enabled.

5. Review your vendor risk management program against the data. Benefits platforms are now a recurring source of breaches in FinSecLedger's breach tracker. If your third-party risk assessment program doesn't include benefits administrators alongside traditional financial services vendors, it has a gap.