Hungarian Headhunting Platform Switch Exposes 5,397 Applicant Records via Public GitHub Repository
What Happened
In October 2024 the Hungarian IT headhunting service Switch inadvertently published a public GitHub repository that contained 5,397 job‑application records. The leaked data included applicant names, email addresses, social‑media profile links and, in some cases, commentary attached to the applications.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous control‑assurance over code‑base and repository permissions – a core element of a defensible data‑handling program.
- Highlights how an accidental exposure can trigger GDPR‑triggered breach notification obligations and other privacy‑law requirements.
- Shows the importance of maintaining auditable evidence that data‑classification, least‑privilege access, and automated scanning controls are in place and regularly verified.
Who Is Affected
- IT recruitment and headhunting services operating in the EU.
- SaaS platforms that store applicant data (HRIS, job‑board providers).
- Organizations that submitted candidates to Switch for hiring.
Recommended Actions
- Conduct an immediate inventory of all public repositories and remove any residual applicant data.
- Validate that repository‑access policies enforce least‑privilege and that automated secret‑scanning tools are active.
- Initiate a GDPR breach assessment, notify the supervisory authority if required, and communicate with affected applicants.
- Document the incident in your continuous control‑assurance logs to evidence remediation and future‑state controls.
Technical Notes
- Attack vector: Accidental data exposure via a publicly accessible GitHub repository.
- CVEs: None reported.
- Data types exposed: Email addresses, full names, job‑application content, social‑media profile URLs, applicant commentary.