Jobandtalent Breach Exposes 10.9 M Accounts, Including Password Hashes
What Happened — In February 2018 the recruitment platform Jobandtalent suffered a data breach that exposed 10,981,207 user records. The compromised data included names, email addresses, IP addresses and passwords stored as salted SHA‑1 hashes, and the dataset later appeared for sale on underground forums.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential‑storage practices in a third‑party SaaS provider.
- Highlights the need for continuous monitoring of vendor security controls and evidence of strong encryption/hashing.
- Provides a concrete example of why a defensible audit trail of third‑party risk assessments is essential for compliance programs.
Who Is Affected — Recruitment‑technology firms, job‑seeker databases, HR SaaS providers, and any organization that integrates with Jobandtalent’s API.
Recommended Actions
- Verify that all vendors handling credential data use modern, computationally‑hard hashing (e.g., bcrypt, Argon2) and enforce MFA.
- Incorporate the vendor into a continuous third‑party risk monitoring program; collect and retain evidence of their security posture for audit readiness.
- Prompt affected users to reset passwords and monitor for credential‑stuffing attempts.
Technical Notes — The breach involved the extraction of salted SHA‑1 password hashes, a weak algorithm by today’s standards. Exposed fields: email, name, IP address, and password hash. Source: https://haveibeenpwned.com/api/v3/breach/JobAndTalent