HackerOne Says 287 Employees May Be Affected by Navia Data Breach
Summary
Navia reported unauthorized access and acquisition of personal and health-plan information, affecting nearly 2.7 million people. HackerOne says 287 employees may be affected; it is investigating with Navia.
Key points
- Navia said an attacker accessed its systems from December 22, 2025, to January 15, 2026; the company discovered the access on January 23.
- Navia said the attacker accessed and acquired names, birth dates, Social Security numbers, contact details, and health-plan information.
- Navia reported nearly 2.7 million people affected to the Maine Attorney General’s Office.
- HackerOne said 287 employees may have been affected through Navia, one of its U.S. benefits administrators.
- HackerOne said it is investigating and reviewing Navia’s privacy and security practices.
- Navia said it was unaware of attempted or actual misuse of the exposed information; the article reports no indication that stolen data was publicly released.
Article Details
- Victim Organization
- Navia Benefit Solutions
- Incident Type
- Unauthorized access and data breach
- Incident Date
- 2025-12-22
- Data Types Exposed
- Names
- Dates of birth
- Social Security numbers
- Phone numbers
- Email addresses
- Health plan information
- Affected Records
- Nearly 2.7 million individuals were reported impacted; information of 287 HackerOne employees may have been affected.
- Operational Impact
- No operational disruption was reported.
- Ransom Or Extortion
- No ransom or extortion activity was reported.
- Claim Status
- confirmed