Monster.com Attacked, User Data Stolen

Placid writes "The BBC has an article detailing a successful attack on the US recruitment site, Monster.com. According to the article, 'A computer program was used to access the employers' section of the website using stolen log-in credentials' and that the stolen details were 'uploaded to a remote web server'. Apparently, this remote server 'held over 1.6 million entries with personal information belonging to several hundred thousands of candidates, mainly based in the US, who had posted their resumes to the Monster.com website'. The article also links the break-in to a phishing e-mail sent out recently where personal details were used to entice users to download a 'Monster Job Seeker Tool.'"

Comments

Tomorrow's Ad today

[JonTurner]

Wanted:
New sysadmin. Must have experience in data security. Submit resume to adminjob@monster.com

Re:Tomorrow's Ad today

[Harmonious Botch]

I did it. Hire me.

Re:Tomorrow's Ad today

[high_rolla]

Yeah, followed by the new marketing campaign: "Nobody else makes it this easy for your details to reach more employers"

Phishing Attack

[grahamux]

You know, every time I get an email telling me my Bank of America account is going to be frozen, and should go to http://myaccounts-bankofamerica.net/ I always ask myself "Who actually falls for this stuff?". Now, I know. The people I look to for jobs. /cheer

Re:Phishing Attack

[Farmer Tim]

What, you needed more evidence that your (potential) boss is an idiot?

Re:Phishing Attack

[jombeewoof]

It seems to be a universal fact that to be in HR you need to always have an IQ lower then the people you are interviewing. It certainly has been in every company i've worked at.

remember, these are the type of people who were putting "5 years experience required in windows 2003 admin" in 2005.

I have the official HR handbook. The basic rule is "You can be NO smarterer than the chair you sit in"

Re:Phishing Attack

[kalirion]

How can I unfreeze the account if your link is broken? Ah well, could you please unfreeze it for me? My BOA username/password is kalirion/password123. Thanks a ton!

o noes

[yourmomisfasterthana]

now hundreds of millions will be able to see my resume, instead of the usual tens of millions!

Hehe

[JimboFBX]

Last year, a British nurse was blackmailed by hackers who had used a Trojan to access her personal e-mails. I'll let you guys stew on how ambiguiously funny that sentence is.

The real question is

[EEPROMS]

Who actually wants this data, many will think it just some Russian hacker but this doesnt feel right to me. I wouldn't be surprised its a government agency collecting data the easy way.

In Soviet Russia...

[Anonymous Coward]

In Soviet Russia, Monster.com attacks you!

cue sound:

[doyoulikeworms]

M-M-M-Monster Kill (...kill...kill...kill...kill...)

They got me!

[Chris Pimlott]

What a nightmare, I'm already being flooded by dozens of job offers for adult websites development...

Copied, not stolen

[Meneth]

Seriously, if even Slashdot can't use the word properly, how can we ever expect the MAFIAA to learn?

New ads on Monster tomorrow:

[grasshoppa]

Seeking networking security professional for immediate vacancy.

Best headline ever

[FrostedWheat]

This story has the best headline I've seen on the BBC in a long time:

Monster attack steals user data

Ruh-roh! Someone call the Scooby Gang!

Re:Porn

[clickclickdrone]

I know this will get modded down but...
>thousands of minutes of erotic movies
TIP: say hundreds of *hours*. Saying minutes really implies your target audience don't umm, last very long IYSWIM. Not good marketing to insult them up front.

Re:"US recruitment site"??

[Bloke down the pub]

Nobody speaks the English which was spoken when America was colonized.

Sir, you are quite mistaken, and if you persist in perpetuating these fallacious fripperies I shall be honour bound to demand that you perambulate into my vicinity and repeat them, on pain of fisticuffs. Good day!

Re:Monster doesn't help anyway--why use it?

[penguin_dance]

Craigslist...right.... Lots of ads, like the following:

WEB DEVELOPER needed for growing company, must be prorficient [sic] in PHP, ASP, ASP.NET, C++, Java and XHTML. Students welcome. $10 hr.

Oh, and here's a title from an actual ad now running (you can't make this stuff up):
Big Dog Web Developers Needed for a Big Back End

I don't even want to know.

Re:Blame the data security officers & project

[ari wins]

Maybe the best thing that occurs from all this is we, on the sidelines, learn from their mistakes.

I'd love to, but then I'd actually have to RTFA, and I don't have time today. I have to get a copy of my birth certificate and a visa, so I can help out my new Nigerian friend with a lucrative situation.