Hackers attack world's largest jobs site

Blackmail demands followed the theft of personal details - including home addresses and phone numbers - from Monster.com

Jonathan Richards

Hundreds of thousands of people have been exposed to the risk of blackmail after the website of the world's largest online recruiter was hacked.

Personal details stored on Monster.com, a website that lists job vacancies, were taken after a raid by hackers who posed as employers to gain access to the site.

Having stolen the information, hackers e-mailed the victims claiming to have infected their computers with a virus and threatening to delete files unless demands for payment were met.

In all, more than 1.6 million entries in Monster's system - belonging to "several hundred thousand" members - were taken after the hackers logged in using the details of employers who routinely scour the site for prospective workers, according to Symantec, the security firm.

The details, which included names, surnames, e-mail and home addresses, as well as phone numbers, were then used to send 'phishing' e-mails to members, apparently from Monster.com, encouraging them to download a tool known as 'Monster Job Seeker'.

The tool was in fact a malicious program known as a 'trojan', which encrypted the files on the victim's machine, making them inaccessible to the computer owner. A message was left requesting that money be paid to the attackers before the files - which could include photos and other personal documents - would be decrypted.

Monster.com told Times Online that it was possible information relating to the 3.2 million Britons who use the site could have been taken, but that it could not be sure because it didn't know which of its servers had been affected.

It confirmed that some British information is stored on its servers in the US, but said that Symantec's report had been based on a separate 'remote server' on which the stolen details had been posted - and which showed the trail back to Monster - rather than on Monster's servers themselves.

"We're still investigating - we don't yet know how this information was obtained, other than that it was downloaded using the login details of legitimate customers of ours," Patrick W Manzo, vice president for fraud prevention at Monster.com, said.

"It seems likely it was done over a period of time, because we would have noticed such a vast quantity of details being taken all in one go."

A statement from the company said that it would "take all necessary steps to mitigate the issue, including terminating any account used for illegitimate purposes".

Symantec, the security firm which reported the breach, said that such a large database of personal information was "a spammer's dream".

"This remote server held over 1.6 million entries with personal information belonging to several hundred thousand candidates, mainly based in the US, who had posted their r‚sum‚s to the Monster.com website," a posting on the Symantec blog said.

Symantec said that the e-mails sent to victims appeared very realistic, carrying the official Monster logo and containing personal information that users had posted on the site in their CV.

The breach was a new twist on a traditional hack used against corporate databases, security experts said, because the attackers stole log-in details of legitimate users of the database - in this case employers - which in turn granted them access to the vast pool of information it contained.

"We are seeing more and more of this extortion-based threat, and in some cases hackers are demanding victims pay up or face a file being deleted from their machine every half hour," Graham Cluley, a security expert at Sophos, said.

Last year, a British woman was blackmailed after hackers used a trojan to gain access to her personal e-mails.

Symantec advised users of recruitment sites to limit the personal information they posted, and to use a separate, disposable e-mail address rather than their main personal account. Users who feared they may have been affected were encouraged to contact a security vendor and have their machine examined.

Monster.com claims to the be the world's largest online jobs listing site, with 73 million resumes held globally. It helps place candidates in a range of positions at blue-chip companies including HSBC, Bloomberg, Accenture and T-Mobile.

As of this afternoon more than 110,000 UK-based jobs were advertised on the site, which was set up in 1994.

BBC