Recent Navia data breach impacts HackerOne employee data

**Executive summary:** A breach at Navia Benefit Solutions resulted in unauthorized access to personal data for approximately 2.7 million people and exposed sensitive information for roughly 287 HackerOne employees; attackers leveraged a Broken Object Level Authorization (BOLA) vulnerability to access names, Social Security numbers, dates of birth, contact information and benefits enrollment details between Dec 22, 2025 and Jan 15, 2026, with detection on Jan 23 and subsequent notifications and mitigation steps initiated.