HackerOne Notifies 287 Employees of Navia Data Breach

HackerOne, a prominent bug bounty platform, has notified 287 employees that their personal information was exposed in a data breach at Navia Benefit Solutions, a third-party provider handling employee benefits. The incident, which occurred through a vulnerability in Navia's systems, underscores the risks of supply chain attacks and affected sensitive details for workers at the cybersecurity-focused company.

The breach at Navia stemmed from a broken object level authorization flaw that allowed unauthorized access from December 22, 2025, to January 15, 2026. Navia detected suspicious activity on January 23, 2026, and launched an investigation, determining that personal data had been compromised. The company notified affected organizations via letters dated February 20, 2026, though HackerOne did not receive its copy until March, prompting criticism over the delay.

For HackerOne's employees, the exposed information included combinations of full names, Social Security numbers, addresses, phone numbers, dates of birth, email addresses, and details on health and non-health benefits participation, such as enrollment, effective, and termination dates. Data for dependents was also...