Monster.com says a third-party exposed user data, but didn’t tell anyone

ronjor · Sep 5, 2019

Zack Whittaker@zackwhittaker 05 Sep 2019

An exposed web server storing résumés of job seekers — including from recruitment site Monster — has been found online.
The server contained résumés and CVs for job applicants spanning between 2014 and 2017, many of which included private information like phone numbers and home addresses, but also email addresses and a person’s prior work experience.
Click to expand...

guest · Sep 9, 2019

Monster Defends Data Leak Response
September 9, 2019
https://www.infosecurity-magazine.com/news/monster-defends-data-leak-response/

Sensitive personal data uploaded to a popular recruitment site has been found exposed on an unsecured web server after a third-party client failed to keep it secure.
However, although some were identified as having been posted to Monster, the jobs site clarified that the issue was actually the fault of one of its customers.

“We alerted the customer and the customer immediately resolved the issue,” said the firm’s chief privacy officer, Michael Jones, in a statement sent to Infosecurity. “As a result of this incident, we have terminated the customer’s contract.”
He went on to explain why Monster should not be held responsible for the incident.

“As the exposure occurred on a customer system, and involved customer data obtained from multiple sources, we were not able to identify affected individuals or affected information.”

“This is a lesson in how data can spread without people being aware of it. In this case, when we put our job history and résumés/CVs on these types of sites, we should assume that organizations are going to collect them as they review and use them for job considerations,” argued Erich Kron, security awareness advocate for KnowBe4.
Click to expand...

guest · Sep 14, 2019

How Much Responsibility Should Monster.com Take for Third Party Data Breach?
September 13, 2019
https://www.cpomagazine.com/cyber-s...monster-com-take-for-third-party-data-breach/

An unnamed security researcher discovered the breach and contacted Monster.com and TechCrunch. Monster.com did not acknowledge the breach until TechCrunch reporters contacted them about it.
He also stated that Monster.com does not consider itself responsible for reporting third party data breaches as the client “owns the data.”
Should Monster.com be held accountable for a third party data breach?
The argument that Monster.com makes is not completely without merit. If the customer provides the company with personal data knowing that the company will sell it, the company has only so much control over (and thus responsibility for) what its data partners do with it.

There are a number of factors that complicate this argument, however. The first is how well-informed the customer really is about how their data is being used.
Another issue is the company’s reputation. Even if it is a former business partner that is entirely responsible for a third party data breach, the headlines will give the impression that it is data they are solely responsible for.
Click to expand...

“Once again, third party risk is shown to be the great cybersecurity risk multiplier. But this case should serve as a wake-up call to every consumer – our data is not our own. Aggregated data is being traded for massive profits, and like mortgages and other debt, it is packaged and sold with no come-back.
“Monster washes its hands of responsibility for your data security the moment it sells it – ‘Customers that purchase access to Monster’s data – candidate résumés and CVs – become the owners of the data and are responsible for maintaining its security,’ the company said.

Why would anyone trust any business with their data when it is being pimped out like this?
Click to expand...

Log in or Sign up

Monster.com says a third-party exposed user data, but didn’t tell anyone

ronjor Global Moderator

guest Guest

guest Guest

Log in or Sign up

Monster.com says a third-party exposed user data, but didn’t tell anyone

ronjor Global Moderator

guest Guest

guest Guest

Useful Searches