The job website says it cannot notify users since the exposure occurred on a third-party organization's servers.
An unprotected Web server has been offering information on Monster.com users for some time — and neither Monster nor the third party it says purchased the data has notified the victims.
According to reports, private information on job seekers using the site from 2014 through 2017 exposed includes phone numbers, home addresses, email addresses, and prior work experience. No financial information was included.
"The personally identifiable information typically found on a résumé can lead to account hijacking and highly targeted phishing attacks if it falls into the wrong hands," Vinay Sridhara, CTO of Balbix, told SiliconANGLE. "In fact, a threat actor can have password reset codes sent to a compromised phone number or email for far more sensitive accounts – both personal and professional."
Monster has said it cannot notify users since the exposure occurred on a third-party organization's servers — an unnamed third party with which Monster says it no longer does business. According to Monster, the server was secured after it was notified of the situation.
Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "8 Ways To Spot an Insider Threat."
About the Author(s)
You May Also Like
Guarding the Cloud: Top 5 Cloud Security Hacks and How You Can Avoid Them
April 4, 2024Cybersecurity Strategies for Small and Med Sized Businesses
April 11, 2024Defending Against Today's Threat Landscape with MDR
April 18, 2024Securing Code in the Age of AI
April 24, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024Black Hat Asia - April 16-19 - Learn More
April 16, 2024