Ethical Hacking News
HackerOne has disclosed a devastating employee data breach following a hack on Navia, one of its U.S. benefits administrators. The breach left hundreds of employees with sensitive information stolen from them, highlighting the need for companies to prioritize employee data protection and cybersecurity measures.
HackerOne disclosed a devastating employee data breach following a hack on Navia, one of its U.S. benefits administrators. The breach exposed hundreds of employees' sensitive information, including Social Security numbers and personal addresses. The hackers exploited a Broken Object Level Authorization (BOLA) vulnerability to gain access to Navia data between December 22nd, 2025, and January 15th, 2026. Affected employees are advised to monitor their financial accounts for unusual activity and consider changing passwords or password hints/security questions. The incident highlights the need for companies to prioritize employee data protection and cybersecurity measures.
HackerOne, a prominent bug bounty platform that provides vulnerability disclosure, penetration testing, and code security services to high-profile companies, has recently disclosed a devastating employee data breach following a hack on Navia, one of its U.S. benefits administrators.
The breach, which was first reported by Sergiu Gatlan in his March 24th article, left hundreds of employees with sensitive information stolen from them. The hackers exploited a Broken Object Level Authorization (BOLA) vulnerability that led to an unknown actor accessing Navia data between December 22nd, 2025, and January 15th, 2026.
According to the breach report filed by HackerOne with the Office of the Maine Attorney General, the exposed information included a combination of Social Security numbers, full names, addresses, phone numbers, dates of birth, email addresses, plan enrollment dates, effective dates, and termination dates for each affected employee and their dependents. This information could potentially be used to launch phishing and social engineering attacks against individuals impacted by the breach.
The data breach also raised concerns about the impact on employees' claims or financial information, as Navia claimed that the breach did not affect their claims or financial information. However, the exposed data is sufficient for threat actors to carry out targeted attacks, making it crucial for affected employees to be cautious of suspicious messages and monitor their financial accounts for unusual activity.
HackerOne has encouraged impacted employees to take advantage of a 12-month free identity protection and credit monitoring service provided by Navia, as well as consider changing passwords or password hints/security questions if they involve the personal data listed above. The company has also emphasized the importance of being vigilant in the wake of this breach, advising employees to monitor their accounts for any suspicious activity.
The incident highlights the need for companies to prioritize employee data protection and cybersecurity measures. As bug bounty platforms like HackerOne continue to play a crucial role in identifying vulnerabilities, it is essential that these organizations take proactive steps to protect sensitive information from falling into the wrong hands.
Furthermore, this breach serves as a reminder of the ongoing threat landscape and the importance of implementing robust security measures to prevent such incidents. With the increasing sophistication of cyber threats and the growing reliance on digital technologies, it is crucial for individuals and organizations alike to stay vigilant and take proactive steps to protect their sensitive information.
In conclusion, the recent employee data breach disclosed by HackerOne following a hack on Navia serves as a stark reminder of the importance of prioritizing cybersecurity measures. As companies continue to navigate the complex world of digital threats, it is essential that they prioritize employee data protection and implement robust security protocols to prevent such incidents in the future.
Related Information:
https://www.ethicalhackingnews.com/articles/HackerOne-Discloses-Devastating-Employee-Data-Breach-Following-Navia-Hack-ehn.shtml
https://www.bleepingcomputer.com/news/security/hackerone-discloses-employee-data-breach-after-navia-hack/
https://cybernews.com/security/hackerone-navia-data-breach/
https://www.theregister.com/2026/03/24/hackerone_supplier_breach/
https://www.picussecurity.com/resource/blog/lazarus-group-apt38-explained-timeline-ttps-and-major-attacks
https://en.wikipedia.org/wiki/Lazarus_Group
https://en.wikipedia.org/wiki/Fancy_Bear
https://dailysecurityreview.com/resources/threat-actors-resources/apt28-fancy-bear-russian-state-sponsored-apt/
Published: Tue Mar 24 11:03:17 2026 by llama3.2 3B Q4_K_M
