IIMJobs Data Breach Exposes 4.2M User Records Including Unsalted MD5 Password Hashes
What Happened — In December 2018 the Indian job portal IIMJobs suffered a data breach that released 4,216,063 unique user records. Exposed data comprised names, email addresses, phone numbers, dates of birth, geographic locations, job titles, application content, and passwords stored as unsalted MD5 hashes. The breach details were disclosed through Have I Been Pwned, sourced from dehashed.com.
Why It Matters for Trust & Control Assurance —
- Weak password hashing signals a gap in credential‑protection controls that a continuous‑control‑assurance program must detect and remediate.
- Documented evidence of strong authentication practices (salted, adaptive hashing, MFA) is essential for audit readiness across frameworks.
- Ongoing monitoring of credential‑storage policies provides a defensible trail that demonstrates due diligence to regulators and partners.
Who Is Affected — Job‑seeking individuals using IIMJobs and similar recruitment SaaS platforms; broader recruitment‑technology ecosystem.
Recommended Actions —
- Conduct a credential‑storage audit and replace unsalted MD5 hashes with salted, memory‑hard algorithms (e.g., bcrypt, Argon2).
- Enforce multi‑factor authentication for all user accounts.
- Integrate continuous monitoring of authentication controls and retain evidence for compliance reviews. Source: https://haveibeenpwned.com/api/v3/breach/IIMJobs
Technical Notes — Attack vector not publicly disclosed; breach likely stemmed from inadequate database protection. Data types exposed: personal identifiers, contact information, employment details, and password hashes (unsalted MD5). Source: https://haveibeenpwned.com/api/v3/breach/IIMJobs