- HackerOne confirms supply chain breach via Navia benefits provider
- 287 employees’ sensitive data exposed, including SSNs, addresses, and health plan details
- HackerOne criticizes Navia’s slow response; no evidence of data misuse yet, but 2.7 million people affected overall
HackerOne has revealed it was the victim of a supply chain attack in which it lost sensitive employee data.
The company has filed a new report with the Office of the Maine Attorney General, confirming that 287 of its employees lost a combination of: social security number, full name, address, phone number, date of birth, email address, health plan participation (Y/N), non-health plan participation (Y/N), plan enrollment dates, effective dates, and termination dates.
In a letter sent to affected individuals, HackerOne explained in late December 2025 and early January 2026, a threat actor managed to leverage a Broken Object Level Authorization (BOLA) vulnerability in Navia, an employee benefits solutions provider.
Article continues below
No claims yet
“On January 23, 2026, Navia became aware of suspicious activity in their environment. Navia sent letters dated February 20, 2026, to impacted companies,” the letter further reads.
HackerOne said it only received the letter in March 2026, slamming the service provider for its seemingly slow response:
“We are still awaiting additional information about the vulnerability that led to this incident, and a satisfactory reason for the delay in their notification to us,” HackerOne said. The company stressed that it will analyze Navia’s security practices directly and re-evaluate using its services.
So far, there is no evidence to suggest the stolen data is being abused in the wild, HackerOne says. However, it still urges all affected individuals to be careful of incoming emails and other forms of communication, especially those claiming to originate from either HackerOne, or Navia.
Navia handles benefits for more than 10,000 US employers. According to an earlier report by TechRepublic, the Navia breach affected almost 2.7 million people. No threat actor groups have yet claimed responsibility for the attack.
Via BleepingComputer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.
