Benefits Data Exposed Through API Flaws

Navia Benefit Solutions disclosed unauthorized access through a Broken Object Level Authorization flaw that exposed sensitive employee and dependent information, including Social Security numbers, for nearly 2.

7 million people. The incident shows how benefits administrators and integrated service providers can become high-impact data targets when API authorization and monitoring controls fail. A separate Navient incident involving a ransomware attack on an outside law firm reinforces the broader exposure created by third-party environments, although it is not part of the Navia breach.