BigMoneyJobs data breach: 36K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2014-04-08
In April 2014, the job site bigmoneyjobs.com was hacked by an attacker known as "ProbablyOnion". The attack resulted in the exposure of over 36,000 user accounts including email addresses, usernames and passwords which were stored in plain text. The attack was allegedly mounted by exploiting a SQL injection vulnerability. Exposed data: career levels, education levels, email addresses, names, passwords, phone numbers, physical addresses, salutations, user website urls, website activity. The breach dates from Apr 3, 2014; Have I Been Pwned loaded it on Apr 8, 2014.
What to do
- If you had a BigMoneyJobs account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
