HackerOne discloses employee data breach after Navia hack
Recorded: March 24, 2026, 4 p.m.
| Original | Summarized |
HackerOne discloses employee data breach after Navia hack News Featured TeamPCP deploys Iran-targeted wiper in Kubernetes attacks Microsoft Azure Monitor alerts abused for callback phishing attacks Crunchyroll probes breach after hacker claims to steal 6.8M users' data Microsoft Exchange Online service change causes email access issues Microsoft fixes bug causing Classic Outlook sync issues with Gmail Zero Trust: Bridging the Gap Between Authentication and Trust HackerOne discloses employee data breach after Navia hack Infinite Campus warns of breach after ShinyHunters claims data theft Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityHackerOne discloses employee data breach after Navia hack HackerOne discloses employee data breach after Navia hack By Sergiu Gatlan March 24, 2026 Bug bounty platform HackerOne is notifying hundreds of employees that their data was stolen after attackers hacked Navia, one of its U.S. benefits administrators. Red Report 2026: Why Ransomware Encryption Dropped 38% Related Articles: Breach Sergiu Gatlan Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Popular Stories Microsoft Azure Monitor alerts abused for callback phishing attacks Trivy vulnerability scanner breach pushed infostealer via GitHub Actions VoidStealer malware steals Chrome master key via debugger trick Sponsor Posts Overdue a password health-check? Audit your Active Directory for free Overdue a password health-check? Audit your Active Directory for free Are refund fraud methods targeting your brand? You can monitor the underground for these threats. Cyber resilience without the complexity. Join Zero Networks to stop lateral movement fast. AI is a data-breach time bomb: Read the new report Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
HackerOne disclosed a significant employee data breach following a cyberattack targeting Navia, a leading U.S. benefits administrator. The incident, detailed in a filing with the Office of the Maine Attorney General, revealed that an unauthorized actor accessed Navia’s systems between December 22, 2025, and January 15, 2026, exploiting a Broken Object Level Authorization (BOLA) vulnerability. This allowed the attacker to obtain sensitive information pertaining to over 287 HackerOne employees, alongside data concerning approximately 2.7 million individuals associated with Navia’s clients. The compromised data encompassed a wide range of personal details, including Social Security numbers, full names, addresses, phone numbers, dates of birth, email addresses, and records of employee and dependent plan enrollments and terminations. This data presented a considerable risk of targeted phishing and social engineering attacks against individuals affected by the breach. Navia initially characterized the incident as a data theft, however, the perpetrator remains unidentified, and no known cybercrime group has claimed responsibility. In response to the breach, HackerOne advised impacted employees to exercise caution, monitor their financial accounts for suspicious activity, and leverage a 12-month complimentary identity protection and credit monitoring service offered by Navia. Furthermore, the company recommended password updates, particularly for accounts utilizing compromised personal information. Navia emphasized that the breach did not compromise claims or financial details, a crucial distinction that likely mitigated some immediate concerns. The disclosure of this breach highlights vulnerabilities within complex benefit administration systems and underscores the importance of robust authorization controls, such as BOLA, to prevent unauthorized access. The lack of immediate attribution suggests a sophisticated attacker who meticulously planned and executed the intrusion. Further investigation is likely underway to determine the attacker's motives and potential impact. The incident also serves as a cautionary tale for companies managing sensitive employee data, emphasizing the necessity of proactive security measures and timely incident response procedures. |