The job website says it cannot notify users since the exposure occurred on a third-party organization's servers.
An unprotected Web server has been offering information on Monster.com users for some time — and neither Monster nor the third party it says purchased the data has notified the victims.
According to reports, private information on job seekers using the site from 2014 through 2017 exposed includes phone numbers, home addresses, email addresses, and prior work experience. No financial information was included.
"The personally identifiable information typically found on a résumé can lead to account hijacking and highly targeted phishing attacks if it falls into the wrong hands," Vinay Sridhara, CTO of Balbix, told SiliconANGLE. "In fact, a threat actor can have password reset codes sent to a compromised phone number or email for far more sensitive accounts – both personal and professional."
Monster has said it cannot notify users since the exposure occurred on a third-party organization's servers — an unnamed third party with which Monster says it no longer does business. According to Monster, the server was secured after it was notified of the situation.
Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "8 Ways To Spot an Insider Threat."
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024