Explore Talent Breach Exposes 5.37 M Candidate Records
What Happened — In July 2024 a breach attributed to the recruiting platform Explore Talent was posted on a public hacking forum. The dump contains 5,371,574 records (≈5.4 M unique email addresses) with names, phone numbers and physical addresses. The compromise appears to have occurred sometime between early 2022 and 2023.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient third‑party oversight – a core scenario that continuous vendor‑risk monitoring is designed to detect and document.
- Highlights the need for auditable evidence that vendors protect personal data, enabling a defensible response to regulators or customers.
- Reinforces the importance of maintaining an up‑to‑date incident‑response playbook that includes supply‑chain breach notifications.
Who Is Affected – HR‑tech SaaS providers, recruiting agencies, employers that use Explore Talent, and the millions of job candidates whose personal data were exposed.
Recommended Actions
- Map this incident to your vendor‑oversight control objective and verify that contractual security clauses are being enforced.
- Collect and retain evidence of due‑diligence activities (risk assessments, security questionnaires, monitoring logs).
- Update your incident‑response plan to include notification procedures for third‑party data exposures.
Technical Notes – The breach was disclosed via Have I Been Pwned (HIBP) and posted on a hacking forum; the exact attack vector remains unknown. Exposed data: email addresses, full names, phone numbers, physical addresses.