Breach Disclosure: Jobandtalent

Jobandtalent, a digital temp staffing agency, experienced a data breach in February 2018. This breach exposed data for 11 million user accounts, including email addresses, names, IP Addresses, passwords (SHA-1 hashes) and was advertised on popular hacking sites for users to download.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

In early February 2018, the hacker group known as "GnosticPlayers" were able to compromise Jobandtalent and posted the data for sale on the now defunct dark web marketplace, Dream Market for ฿0.4669. This data was later made available in 2019 on other hacking forums, such as RaidForums for users to download for a few credits.

GnosticPlayers were responsible for many breaches in recent years, and alongside the Jobandtalent breach, they also listed Legendas.tv, Onebip, StoryBird, StreetEasy, GfyCat, ClassPass, and Pizap.

imgur Figure 1: Breach advertisement on RaidForums