HackerOne Navia 2025 Data Breach

HackerOne's notification attached to the regulatory record explains that Navia held benefits data on the company's behalf and that it was informed a Broken Object Level Authorization vulnerability allowed an unknown person to access the data. The Maine Attorney General filing identifies 287 affected HackerOne employees. Together, these documents confirm actual data theft and the company-specific scope.

BleepingComputer compared the regulatory documents and published the access window, employee total, affected fields, and Navia timeline. Navia detected suspicious activity on January 23, 2026, and sent letters dated February 20 to impacted companies.

Depending on the person, the data may include a combination of Social security numbers, full names, physical addresses, phone numbers, dates of birth, and email addresses. It can also include benefits-plan enrollment dates, effective dates, and termination dates describing employment and plan relationships. Information about relevant dependents may have appeared within employee files.

Not every field should be assumed to have appeared for all 287 employees or every dependent. The notice describes a combination and provides no category-level subtotals.

Broken Object Level Authorization occurs when an application does not adequately verify whether a user may access a requested object or record. According to information passed to HackerOne, this flaw enabled an unknown actor to reach Navia data. The entry uses this as the provider-reported technical explanation and does not speculate about the exact endpoint or exploit code.

The incident does not mean HackerOne's bug-bounty platform or customer security programs were compromised. The affected environment was Navia, which HackerOne used for employee benefits. HackerOne customers, researchers, and program data should not be treated as victims solely because of their relationship with the company.

The affected-person or record count published by the official source represents the reported scope of the incident. It does not mean that every disclosed data category applied to every person. This number is not a new pool of unique people added on top of the overall Navia total; it is a company-level subset of the same incident. One person can be represented in both the parent Navia entry and this HackerOne entry.

The purpose of the child entry is not to inflate an aggregate but to let HackerOne employees find the incident and their specific scope when searching by company. LeakData preserves the relationship in the title, source, tags, and description. It does not create a second attack, separate access window, or independent attacker claim.

Navia offered affected people 12 months of complimentary identity protection and credit monitoring. HackerOne advised employees to watch for suspicious messages, monitor financial accounts for unusual activity, and consider changing password hints or security questions if they rely on the personal information listed in the notice.

People whose Social Security number or birth date was involved may consider a credit freeze or fraud alert. Criminals who know benefits-enrollment dates can impersonate human resources or a health plan, so employees should verify messages requesting plan changes, bank details, or identity documents through known HackerOne and Navia channels.

The incident date is based on the earliest technical activity that can be verified from public sources. Access continued through January 15, 2026, Navia detected suspicious activity on January 23, company notices followed in February, and the regulatory disclosure became public in March. These dates form the timeline of one parent Navia incident.

The verified HackerOne subset is 287 employees, with some information about employee dependents potentially involved. Names, contact and address details, birth dates, Social security numbers, and plan enrollment and effective dates were affected. Claims and financial information are excluded, and the HackerOne platform and customer programs are not presented as compromised. If a suspicious message or account event appears, it should be verified through the organization’s current official contact channel without using links in the message.