A data breach at Navia, a benefits provider, has exposed the personal information of nearly 300 HackerOne employees. The bug bounty company is criticizing Navia for delaying notification of the breach by several weeks. This delay has raised concerns about the effectiveness of Navia's incident response and notification procedures. HackerOne has taken steps to notify and protect its affected employees, but the incident highlights the importance of prompt breach disclosure. The breach is a significant concern for companies that rely on third-party providers to manage sensitive employee data. The incident has also sparked questions about the security controls in place at Navia, including whether any specific vulnerabilities, such as CVEs, were exploited1. This matters to security practitioners because it underscores the need for rigorous vendor risk management and swift breach notification to mitigate the impact of a data breach.