--- title: HackerOne slams supplier over delayed breach notice description: Nearly 300 HackerOne employees had sensitive personal data exposed after a Broken Object Level Authorization (BOLA) vulnerability was exploited in Navia... canonical: https://daily.dev/posts/hackerone-slams-supplier-over-delayed-breach-notice-sojcydte9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: HackerOne slams supplier over delayed breach notice | daily.dev og:description: Nearly 300 HackerOne employees had sensitive personal data exposed after a Broken Object Level Authorization (BOLA) vulnerability was exploited in Navia... og:url: https://daily.dev/posts/hackerone-slams-supplier-over-delayed-breach-notice-sojcydte9 og:image: https://api.daily.dev/og/posts/sOjcyDTE9.png og:image:alt: HackerOne slams supplier over delayed breach notice og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HackerOne slams supplier over delayed breach notice **[The Register](https://daily.dev/sources/theregister)** · 3 min read · 0 upvotes · 0 comments ## Summary Nearly 300 HackerOne employees had sensitive personal data exposed after a Broken Object Level Authorization (BOLA) vulnerability was exploited in Navia Benefit Solutions, a third-party employee benefits administrator. The breach occurred between December 22, 2025 and January 15, 2026, but HackerOne didn't receive formal notification until March — weeks after Navia detected suspicious activity in late January. HackerOne publicly criticized Navia for the delayed disclosure and is reviewing whether to switch benefits providers. The broader Navia breach affected over 2.6 million people. Compromised data includes Social Security Numbers, health plan details, and personal identifiers — prime identity theft material. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [2.7 million hit in workplace benefits data breach exposing SSNs, dates of birth and health account data](https://daily.dev/posts/2-7-million-hit-in-workplace-benefits-data-breach-exposing-ssns-dates-of-birth-and-health-account-d-g44lfrkw5) · IT Security Guru · 0 upvotes · 0 comments - [Nissan Discloses Employee Data Breach Linked to Oracle Zero-Day Attacks](https://daily.dev/posts/nissan-discloses-employee-data-breach-linked-to-oracle-zero-day-attacks-gcfmvg3iw) · Security Boulevard · 0 upvotes · 0 comments - [I found a Vulnerability. They found a Lawyer.](https://daily.dev/posts/i-found-a-vulnerability-they-found-a-lawyer--8i04jlej6) · Hacker News · 0 upvotes · 0 comments - [BOLA: Enumerating an Entire Employee Directory Through a Predictable ID](https://daily.dev/posts/bola-enumerating-an-entire-employee-directory-through-a-predictable-id-5lh2ad7fu) · InfoSec Write-ups · 0 upvotes · 0 comments - [Betterment breach scope pegged at 1.4M users](https://daily.dev/posts/betterment-breach-scope-pegged-at-1-4m-users-y8majqbox) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/hackerone-slams-supplier-over-delayed-breach-notice-sojcydte9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"HackerOne slams supplier over delayed breach notice","url":"https://daily.dev/posts/hackerone-slams-supplier-over-delayed-breach-notice-sojcydte9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackerone-slams-supplier-over-delayed-breach-notice-sojcydte9"},"datePublished":"2026-03-24T13:34:10.475Z","dateModified":"2026-03-24T13:34:33.793Z","description":"Nearly 300 HackerOne employees had sensitive personal data exposed after a Broken Object Level Authorization (BOLA) vulnerability was exploited in Navia...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fcc6b2ecb36ed651d60e3249f32ce6bc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fcc6b2ecb36ed651d60e3249f32ce6bc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackerone-slams-supplier-over-delayed-breach-notice-sojcydte9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-breach","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"HackerOne slams supplier over delayed breach notice"}]} ```