HackerOne Reports Employee Data Exposed in Navia Breach
Summary
HackerOne says a BOLA flaw at benefits administrator Navia exposed personal data belonging to 287 employees between Dec. 22, 2025, and Jan. 15, 2026. Navia said claims and financial information were unaffected.
Key points
- HackerOne reported that an unknown actor accessed Navia data through a Broken Object Level Authorization (BOLA) vulnerability.
- The reported access occurred from December 22, 2025, to January 15, 2026; Navia became aware of suspicious activity on January 23.
- Information associated with 287 HackerOne employees and their dependents was exposed, including Social Security numbers, names, addresses, phone numbers, and dates of birth.
- Navia sent letters to impacted companies dated February 20, 2026, and is providing 12 months of identity protection and credit monitoring.
- Navia said affected individuals' claims and financial information were not impacted.
- The exposed data could support targeted phishing and social engineering; no cybercrime group or ransomware operation has claimed responsibility.
Article Details
- Victim Organization
- Navia
- Incident Type
- Data breach and data theft following unauthorized access through a Broken Object Level Authorization (BOLA) vulnerability. Access to Navia data was reported for the period 2025-12-22 through 2026-01-15.
- Incident Date
- 2025-12-22
- Disclosure Date
- 2026-02-20
- Data Types Exposed
- Social Security numbers
- Full names
- Addresses
- Phone numbers
- Dates of birth
- Email addresses
- Plan enrollment dates
- Effective dates
- Termination dates
- Affected Records
- 287 HackerOne employees were reported affected; the exposed information also included data about their dependents.
- Operational Impact
- Navia reported that affected individuals' claims and financial information were not impacted. The exposed personal data could enable targeted phishing and social engineering. Navia offered 12 months of identity protection and credit monitoring.
- Ransom Or Extortion
- No cybercrime group or ransomware operation has taken responsibility. No ransom demand is reported.
- Claim Status
- confirmed