SQL Injection Breach Exposes 36,789 Accounts on BigMoneyJobs Job Site
What Happened — In April 2014, the job‑search site bigmoneyjobs.com was compromised by an attacker known as “ProbablyOnion.” Exploiting a SQL‑injection vulnerability, the attacker extracted 36,789 user records that included email addresses, names, plain‑text passwords, phone numbers, physical addresses, and other personal details.
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous vulnerability‑management and secure‑coding controls to prevent injection attacks.
- Underscores the requirement to encrypt credential storage and retain auditable evidence of remediation.
- Aligns with the control objective of secure development and credential protection, which can be demonstrated through Verisq’s Control Mapping capability.
Who Is Affected — Online recruitment platforms, job boards, and the job‑seekers whose data were exposed.
Recommended Actions
- Conduct a comprehensive vulnerability scan and remediate all injection flaws.
- Implement strong password hashing (e.g., bcrypt, Argon2) and enforce secure credential storage policies.
- Document remediation steps in a continuous control‑assurance platform to provide defensible audit evidence. Source: [HIBP]
Technical Notes — Attack vector: SQL injection exploiting a web‑application flaw. Data types exposed: career/education levels, email, names, passwords (plain text), phone numbers, physical addresses, salutations, user website URLs, website activity. Source: [HIBP]