HackingFinancial ServicesFinanceVulnerability ExploitData ExfiltratedTargetedIdentity (basic)Government IDHealth (basic)MediumContained

Navia Benefit Solutions, Inc.

bd_7e58946c463fbc0e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 23, 2026

Filed

Mar 23, 2026

To disclose

8 weeks

Affected · nationwide

2871 in this filing

Linked

3 filings

Confidence

66%

Navia Benefit Solutions, Inc. reported a security incident where an unknown actor exploited a Broken Object Level Authorization (BOLA) vulnerability to access employee and dependent data between Dec 22, 2025, and Jan 15, 2026. Navia discovered suspicious activity on Jan 23, 2026. Data exposed included SSNs, names, addresses, DOBs, and health plan details for 287 individuals. Navia notified law enforcement and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Maine clockDiscovered Jan 23, 2026 → Filed with AG Mar 23, 202659d ⏱ ME AG >30d8 weeks discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 32 days

discovery → filing · 8 weeks / 59 days

Dec 22, 2025

Begins

Jan 23, 2026

Discovered

Mar 23, 2026

Filed

vs. sector median

on median

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Indiana State AGbd_061161adbd92b99e2026-03-18 · +5dCandidate
Indiana State AGbd_163f3268394278612026-03-18 · +5dCandidate

Name: Navia Benefit Solutions, Inc.
norm: navia benefit solutions
Domain: hackerone.com

Name: Navia Benefit Solutions, Inc.
norm: navia benefit solutions
Domain: hackerone.com
Industry: Financial Servicesllm

Discovered: Jan 23, 2026
Breach occurred: Dec 22, 2025 – Jan 15, 2026
Undetected for: 32 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 17, 2026
Affected individuals: 287state + nationwide
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Date of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Federal law enforcement was notifiedWill notify applicable regulatory authorities as necessary
Third party: via HackerOne Inc.
Initial access: exploit_public_facing

During the incident: Launched an investigation to confirm the nature and scope of the incident
Conducted a thorough review of the activity to determine which individuals may have been impacted
Notified potentially impacted individuals
Federal law enforcement was notified
Offering 12-24 months of complimentary access to credit monitoring services through Kroll
Changes made: Reviewing the security of our systems
Reviewing the contents of relevant data for sensitive information
Continuing to review policies, procedures and processes related to the storage and access of personal information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: ME AG >30d · 59d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.
Clock breakdown: Statute Window Elapsed Threshold Status
Maine
Discovered: Jan 23, 2026
→ Filed with AG: Mar 23, 2026
59d 30 days (soft) ME AG >30d

Statute	Window	Elapsed	Threshold	Status
Maine	Discovered: Jan 23, 2026 → Filed with AG: Mar 23, 2026	59d	30 days (soft)	ME AG >30d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Indiana State AGMar 18 · first

Maine State AG+5d · this page

Pattern: first filing Mar 18 (IN), last Mar 23 (ME) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/7a57bd2b-9c89-4b3c-8ff9-41f55eea067c.html
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 23, 2026
Raw hash: 2245198235630c97a6754df4d33134afed6e7da53d9e682cb351f02413b787dd

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNavia Benefit Solutions, Inc.

Victim entityNavia Benefit Solutions, Inc.

Incidentdiscovered Jan 23, 2026

Stated responseLaunched an investigation to confirm the nature and scope of the incident

ComplianceME AG >30d

Extraction provenanceno artifact recorded

Source provenancewww.maine.gov