HackerOne discloses employee data breach after Navia hack
HackerOne discloses employee data breach via compromised benefits administrator Navia.
Bug bounty platform HackerOne notified 287 employees that their personal data was stolen after attackers exploited a Broken Object Level Authorization (BOLA) vulnerability in Navia, a U.S. benefits administrator. The breach exposed Social Security numbers, names, addresses, phone numbers, dates of birth, and enrollment information between December 22, 2025, and January 15, 2026. HackerOne, which manages 1,950+ bug bounty programs for major firms and U.S. government agencies, is offering affected employees 12 months of free identity protection and credit monitoring.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonHackerOne experienced a data breach affecting 287 employees through their third-party benefits administrator Navia, which had a Broken Object Level Authorization (BOLA) vulnerability. This incident demonstrates how organizations can be compromised through weaknesses in their vendor ecosystem, even when their own systems remain secure. The breach exposed highly sensitive personal information including Social Security numbers, highlighting the critical importance of third-party risk management. Even security-focused companies like HackerOne are vulnerable when their vendors fail to properly secure systems and implement adequate access controls.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- mitre_attack — Broken Object Level Authorization (BOLA)