Protemps Recruitment Site Breach Exposes 49,591 Jobseeker Records, Including Unsalted MD5 Passwords
What Happened — In October 2021 the Singapore‑based recruitment portal Protemps suffered a data breach that released the personal details of 49,591 job‑seeker accounts. Exfiltrated fields include names, email and physical addresses, phone numbers, passport numbers, gender, marital status, religion, and passwords stored as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of weak credential‑storage practices that a continuous control‑assurance program must detect and remediate.
- Demonstrates the need for documented access‑control policies, regular password‑hash reviews, and auditable evidence that strong hashing algorithms are enforced.
- Highlights how a robust identity‑and‑access‑management (IAM) control set provides defensible proof for auditors and regulators.
Who Is Affected — Recruitment platforms, HR SaaS providers, and the 49 K job seekers whose personal data was exposed.
Recommended Actions
- Immediately replace unsalted MD5 hashes with a modern, salted algorithm (e.g., Argon2, bcrypt, or PBKDF2).
- Enforce multi‑factor authentication for all privileged and user accounts.
- Conduct a control‑mapping exercise to align credential‑storage and access‑control processes with your audit framework of record.
- Capture and retain evidence of the remediation steps in a centralized Trust Center for future audit readiness.
Source: Have I Been Pwned – Protemps breach
Technical Notes
- Attack vector not disclosed; breach likely stemmed from compromised credentials or inadequate database protection.
- Passwords were stored as unsalted MD5 hashes, a cryptographically weak method vulnerable to rainbow‑table attacks.
- Data types exposed span PII (passport numbers, addresses) and authentication secrets.
Source: HIBP breach details