HackerOne Discloses Employee Data Breach After Third-Party Benefits Provider Navia Exposes 2.7 Million Records
Bug bounty platform HackerOne confirms 287 employees had Social Security numbers and personal data exposed through a BOLA vulnerability at benefits administrator Navia, part of a broader breach affecting 2.7 million people.
Overview
HackerOne, the San Francisco-based bug bounty and vulnerability coordination platform, has disclosed that 287 of its employees had sensitive personal data exposed in a breach at third-party benefits administrator Navia Benefit Solutions. The compromise, which ran from December 22, 2025 through January 15, 2026, exploited a Broken Object Level Authorization (BOLA) vulnerability in Navia’s systems and affected approximately 2.7 million individuals across Navia’s client base, according to filings with the Maine Attorney General’s Office reported by BleepingComputer.
The incident is notable for its irony: a company whose entire business is finding and coordinating the disclosure of security vulnerabilities was itself compromised through a well-known class of API flaw in a supplier’s system.
What We Know
Navia Benefit Solutions is a U.S. benefits administrator serving over 10,000 employers nationwide, managing employee enrollment data including health plan details and personal identifiers. According to BleepingComputer, an attacker exploited a BOLA vulnerability — a flaw that allows unauthorized users to access data objects belonging to other users by manipulating API requests — to gain persistent access to Navia’s environment for roughly three weeks.
The exposed data for HackerOne employees includes Social Security numbers, full names, addresses, phone numbers, dates of birth, email addresses, health plan enrollment details, and dependent information, as SecurityWeek reported. HackerOne emphasized that the breach did not affect its own bug bounty platform, internal infrastructure, or customer data.
Navia detected suspicious activity on January 23, 2026, approximately a week after the unauthorized access ended, according to BleepingComputer. The company sent notification letters to affected organizations on February 20, 2026.
What We Don’t Know
Several questions remain unanswered. Navia has stated it found no evidence that the stolen data has been misused, though as SecurityWeek noted, such disclaimers are standard industry language and do not rule out future exploitation. The identity and motive of the attacker remain undisclosed, as does the full technical detail of how the BOLA vulnerability was exploited.
It is also unclear how many of the 2.7 million total affected individuals have been notified. Navia serves thousands of employers, and the scope of outreach to each client’s workforce has not been publicly detailed.
Delayed Notification Draws Criticism
HackerOne has publicly criticized Navia over the timeline of its disclosure. Although Navia sent notification letters on February 20, HackerOne said it did not receive the communication until March, according to The Register. The company stated it is “still waiting for a satisfactory reason for the delay in their notification” to affected employees.
HackerOne told SecurityWeek that “the safe handling of your personal data is core to who we are as an organization, and HackerOne is treating this as requiring our critical attention.” The company said it would conduct its own investigation and evaluate whether to continue using Navia as a benefits administrator.
Analysis
The breach follows a familiar pattern in supply-chain security incidents: a vulnerability in a supplier’s system, a lag between detection and disclosure, and the exposure of sensitive data that the primary organization entrusted to a third party. As The Register observed, HackerOne — a firm dedicated to identifying security problems — fell victim to precisely this scenario.
BOLA vulnerabilities have consistently topped the OWASP API Security Top 10 list, making their presence in a system handling millions of records particularly concerning. For HackerOne, the reputational dimension is acute: the company manages vulnerability disclosures for major enterprises and government agencies, and any association with a preventable breach — even one outside its own perimeter — complicates the trust model on which its business depends.
HackerOne is offering affected employees 12 months of complimentary identity protection and credit monitoring services. Navia has offered 12 to 24 months of credit monitoring through Kroll.