Thanks to Jeremiah Grossman for bringing this story to my attention this evening about Monster.com being hacked again. Well, after a three hour pause, it turns out that the sites Monster.com and USAjobs were, in fact, hacked anew. I paused when it came to writing about this as there was no date on the press releases from Monster.com and USAjobs. Dan Goodin over at the Register has managed to get more on this hack story.
From The Register:
For the second time in 18 months, employment search site Monster.com has lost a wealth of personal data belonging to millions of job seekers after its database was illegally accessed.
The Massachusetts-based website is warning all its customers that their names, birth dates, phone numbers, user IDs and passwords, email addresses, sex and ethnicity have been pilfered. It strongly urges users to change their login credentials immediately and to be on the lookout for phishing emails. The breach prompted this warning from USAJobs, which looks to Monster to run its website.
According to the Reg article the company has elected to not contact users but rather to rely on advisories that have no date. Weird. Do they have the same PR outfit that Heartland uses? So, if you’re resume is on one of these sites then your data is in the wind. But, how?
From Monster’s press release,
We recently learned our database was illegally accessed and certain contact and account data were taken, including Monster user IDs and passwords, email addresses, names, phone numbers, and some basic demographic data. The information accessed does not include resumes. Monster does not generally collect – and the accessed information does not include – sensitive data such as social security numbers or personal financial data.
Immediately upon learning about this, Monster initiated an investigation and took corrective steps. It is important to know the company continually monitors for any illicit use of information in our database, and so far, we have not detected the misuse of this information.
But, there is no mention as to when this happened or even how. Was this the work of an insider, a web hack or something new? The details are scant at best.
“Immediately upon learning about this, Monster initiated an investigation and took corrective steps.”
Oh awesome. For anyone new to this who cannot yet read between the lines, that loosely translates into, “We have no clue what the hell happened or how they got in so we don’t know how to fix it but hopefully this won’t happen again for at least 12 months.”
Just a good reminder that ass saving skills are paramount to job security in the information security field.
Oh brother, Monster.com…Not again!