HackerOne 2026 Employee Data Breach via Navia

Bug bounty platform HackerOne experienced a supply chain breach affecting hundreds of employees. The incident involved unauthorized access to systems at Navia, a U.S. benefits administrator that manages HackerOne's employee benefits programs. HackerOne disclosed the breach in March 2026 after receiving confirmation from Navia about the security incident.

The attack originated through the compromise of Navia's infrastructure, though specific initial access vectors and exploitation techniques remain undisclosed. The breach resulted in exfiltration of employee data from HackerOne's workforce, though the exact data types and fields compromised have not been detailed beyond general employee information. No threat actor attribution or specific ransomware group involvement has been confirmed in this supply chain attack.

HackerOne initiated breach notification procedures to affected employees following confirmation from Navia. The company is coordinating with the third-party administrator to understand the full scope of data exposure and implement additional security measures for employee data protection.