[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSr3Akg478Ukwi2TBmRpq2o9kGv72s-58QyQUzjECMB0":3},{"article":4,"iocs":38,"watch_terms":43,"solutions":44,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":22},"723df3cf-12f8-4eff-ae35-c9a764569d67","HackerOne discloses employee data breach after Navia hack","hackerone-discloses-employee-data-breach-after-navia-hack","Bug bounty platform HackerOne is notifying hundreds of employees that their data was stolen after attackers hacked Navia, one of its U.S. benefits administrators. [...]","Bug bounty platform HackerOne notified 287 employees that their personal data was stolen after attackers exploited a Broken Object Level Authorization (BOLA) vulnerability in Navia, a U.S. benefits administrator. The breach exposed Social Security numbers, names, addresses, phone numbers, dates of birth, and enrollment information between December 22, 2025, and January 15, 2026. HackerOne, which manages 1,950+ bug bounty programs for major firms and U.S. government agencies, is offering affected employees 12 months of free identity protection and credit monitoring.","HackerOne discloses employee data breach via compromised benefits administrator Navia.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackerone-discloses-employee-data-breach-after-navia-hack\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F10\u002F02\u002FHackerOne.jpg","2026-03-24T14:01:02+00:00","2026-03-24T15:00:15.892794+00:00",8,[],"2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":17,"icon":19,"name":20,"slug":21},null,"Breaches","breaches",[23,28,33],{"category":24},{"id":25,"icon":19,"name":26,"slug":27},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":29},{"id":30,"icon":19,"name":31,"slug":32},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":34},{"id":35,"icon":19,"name":36,"slug":37},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[39],{"type":40,"value":41,"context":42},"mitre_attack","Broken Object Level Authorization (BOLA)","Vulnerability exploited in Navia system to access employee data",[],{"controls":45,"vendors":133},[46,75,104],{"slug":47,"name":48,"problem":49,"products":50},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":76,"name":77,"problem":78,"products":79},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":105,"name":106,"problem":107,"products":108},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",[134],{"slug":135,"name":136,"logo_path":137,"roles":138},"hackerone","HackerOne","\u002Fvendor-logos\u002Fhackerone.png",[139],"affected",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":150},"third-party-vendor-vulnerability-exposes-employee-data","Third-Party Vendor Vulnerability Exposes Employee Data","HackerOne experienced a data breach affecting 287 employees through their third-party benefits administrator Navia, which had a Broken Object Level Authorization (BOLA) vulnerability. This incident demonstrates how organizations can be compromised through weaknesses in their vendor ecosystem, even when their own systems remain secure. The breach exposed highly sensitive personal information including Social Security numbers, highlighting the critical importance of third-party risk management. Even security-focused companies like HackerOne are vulnerable when their vendors fail to properly secure systems and implement adequate access controls.",[145,146,147,148,149],"CIS Control 15","NIST SP 800-161","NIST AC-3","ISO 27036","GDPR Article 28",{}]