HackerOne slams supplier for delayed breach notice after staff data exposed

A breach of third-party benefits provider Navia, attributed to exploitation of a Broken Object Level Authorization (BOLA) vulnerability, exposed personally identifiable information (including Social Security numbers, names, addresses, dates of birth, contact details, and health plan data) for over 2.6 million people and affected about 300 HackerOne employees. Navia detected suspicious activity in late January 2026 but notification delays occurred; there is no confirmed misuse yet, though affected parties are advised to monitor for fraud and consider credit protections.