HackerOne Data Breach – Employees Data Stolen Following Navia Hack

HackerOne disclosed that a BOLA vulnerability in its U.S. benefits administrator Navia Benefit Solutions' API was exploited, exposing sensitive personal and health information for about 2.7 million individuals (including 287 HackerOne employees). The unauthorized read-only access occurred in late December 2025–mid January 2026, was detected by Navia on January 23, 2026, and notification to affected parties was delayed, prompting HackerOne to launch its own investigation and warn employees to guard against targeted phishing, identity theft, and fraud.