Explore Talent API Leak Exposes 8.9 M Email Addresses
What Happened — In August 2024 a vulnerable public API on the Explore Talent platform returned raw user records. The flaw allowed unauthenticated queries that harvested 8,929,384 unique email addresses, which were subsequently added to Have I Been Pwned. This exposure is unrelated to the 2022 breach previously reported for the same service.
Why It Matters for Trust & Control Assurance
- Unauthenticated API access bypasses the access‑control safeguards that a continuous control‑assurance program expects to enforce and evidence.
- Lack of real‑time monitoring and logging of API calls makes it difficult to prove due diligence or to generate a defensible audit trail after the fact.
- Demonstrating robust API governance is a single control objective that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001), providing a trust signal to partners and regulators.
Who Is Affected – SaaS recruiting platforms, HR‑tech providers, and any organization that integrates with Explore Talent’s API (primarily the TECH_SAAS sector).
Recommended Actions
- Conduct an immediate API security review: verify authentication, enforce least‑privilege authorization, and close any open endpoints.
- Deploy continuous API monitoring and log aggregation to capture request metadata for audit readiness.
- Map the “access‑control for APIs” control area to your framework of record and collect evidence of remediation. Source: HIBP breach record
Technical Notes – The exposure stemmed from a mis‑configured REST endpoint that returned user records without authentication. No specific CVE was assigned; the data type compromised was email addresses only. Source: HIBP breach feed