Open AWS buckets expose more than 200K CVs at two online recruitment firms

Unsecured AWS servers belonging to two online recruitment firms – U.S.-based Authentic Jobs and Sonic Jobs in the U.K. – have exposed more than 250,000 CVs of job candidates.

Authentic Jobs, used by the likes of the New York Times and EY, took the biggest hit with 221,130 CVs exposed to the public, according to a SkyNews report. At Sonic Jobs, which specializes in recruitment for retail and restaurant jobs and is used by hotel chains Marriott and InterContinental, had at least 29,202 CVs made publicly accessible. 

“When you apply for a job, you share sensitive personal data with the jobs board and the companies to which you’re applying. It’s their responsibility to protect that information from disclosure,” said Tim Erlin, vice president, product management and strategy at Tripwire.

Among the information potentially exposed are names, addresses, job histories and phone numbers.

“An unfortunate consequence of this is that more than
200,000 CVs have now been exposed online,” said Nominet Vice President Stuart
Reed. “Even more worrying is that Amazon buckets come secure by default, so
these companies have changed the settings at some point to allow anyone to view
their data; demonstrating a significant lack of security understanding and best
practice procedures.”

Reed said that two online recruitment firms exposed “shows
that it’s not an isolated case.”

Organizations that use “cloud storage must regularly audit
the permissions to ensure these kinds of breaches don’t happen,” Erlin said.

That includes raising awareness of potential security
weakpoints when it comes to protecting data, particularly in the cloud. “Poor
awareness has led to the exposure of sensitive information, which could now be
used for a range of further criminal activities,” said Reed, noting the widened
digital surface of attack in cloud environments. “Regardless of the security
that cloud services deliver, companies need to take responsibility and ensure
they have a multi-layered approach to their security; including people,
processes and technology.”