Monster.com job database comes under attack by phishers
MASSACHUSETTS - Monster.com, one of the world's largest internet recruitment agencies, has been targeted by cybercriminals in a large-scale phishing scam. Using personal information from the Monster.com client database, the hackers posed as potential employers or Monster.com employees to contact clients in a bid to extract their bank account details and passwords.
Details of the breach were discovered only after computer security firm Symantec reported on its website that it had found a new kind of trojan, called Infostealer.Monstres, which had gathered a hoard of 1.6 million personal records stolen from Monster.com and had uploaded them to a remote server on a computer in Ukraine. The trojan only attacked the "Monster for Employers" site, the section used by recruiters and human resources personnel to search for potential candidates, which was probably accessed using the stolen credentials of a Monster.com employee.
On discovery of the attack, Symantec informed Monster.com, which disabled the affected accounts and posted a warning on its online security centre that clients were being sent fraudulent job offers in an attempt to gain access to their financial information. Monster.com has not reported the crime to police and no arrests have been made.
The threat is not yet over for Monster.com as the personal data stored in the database - from potentially several hundred thousand, mainly US-based, people - could also be used to steal personal identities and perpetrate financial fraud. The personal details and the Monster.com name made the phishing scam appeared more genuine than those most online consumers have become used to. The victims were also expecting to be contacted by strangers with job offers as a result of signing up with the recruitment site.
In a statement, the data vaulting and security specialist Cyber-Ark said the data leakage could have been avoided if the site had maintained its database in a secure and encrypted format. Calum Macleod, European director for Cyber-Ark, said: "Modern encryption and digital vaulting techniques mean personal information uploaded to a website like Monster.com need only be decrypted when the database is interrogated. Using this approach means the data can be held securely on the web server and, even if hackers succeeded in downloading the files, the fact that they were encrypted would render the data unreadable - and therefore unusable."
Only users who have a paid subscription or are part of a corporate subscription are able to print or copy content.
To access these options, along with all other subscription benefits, please contact info@risk.net or view our subscription options here: http://subscriptions.risk.net/subscribe
You are currently unable to print this content. Please contact info@risk.net to find out more.
You are currently unable to copy this content. Please contact info@risk.net to find out more.
Copyright Infopro Digital Limited. All rights reserved.
You may share this content using our article tools. Printing this content is for the sole use of the Authorised User (named subscriber), as outlined in our terms and conditions - https://www.infopro-insight.com/terms-conditions/insight-subscriptions/
If you would like to purchase additional rights please email info@risk.net
Copyright Infopro Digital Limited. All rights reserved.
You may share this content using our article tools. Copying this content is for the sole use of the Authorised User (named subscriber), as outlined in our terms and conditions - https://www.infopro-insight.com/terms-conditions/insight-subscriptions/
If you would like to purchase additional rights please email info@risk.net
More on Regulation
One year on, regulators still want a cure for bank runs
Broad support for higher outflow assumptions on uninsured deposits, but that won’t save insolvent banks
Watchlist and adverse media monitoring solutions 2024: market update and vendor landscape
This Chartis report updates Watchlist monitoring solutions 2022 and focuses on solutions for sanctions (name and transaction) screening and monitoring adverse media and its related elements
Basel Committee reviewing design of liquidity ratios
Focus on LCR and NSFR after Silicon Valley Bank and Credit Suisse, but assumptions may not change
Risk, portfolio margin, regulation: regtech to the rescue
A white paper outlining the complexity of setting the course for risk, margin and regulation
Prop shops recoil from EU’s ‘ill-fitting’ capital regime
Large proprietary trading firms complain they are subject to hand-me-down rules originally designed for banks
Revealed: the three EU banks applying for IMA approval
BNP Paribas, Deutsche Bank and Intesa Sanpaolo ask ECB to use internal models for FRTB
FCA presses UK non-banks to put their affairs in order
Greater scrutiny of wind-down plans by regulator could alter capital and liquidity requirements
Industry calls for major rethink of Basel III rules
Isda AGM: Divergence on implementation suggests rules could be flawed, bankers say
Most read
- Basel Committee reviewing design of liquidity ratios
- Breaking out of the cells: banks’ long goodbye to spreadsheets
- Too soon to say good riddance to banks’ public enemy number one