Xobin, an Indian AI-powered HR tech company, exposed sensitive data of over half a million job seekers due to an unsecured Google Cloud Storage bucket. This included 47 million files with personal details like IDs, passports, resumes, names, phone numbers, and skill assessments.
The leak was found on August 5th, 2024, by Cybernews researchers using OSINT methods. The data was publicly accessible for nearly three months before being secured on November 4th, news report indicated.
Data Impact: Compromised data included:
523,074 applicants’ PII in CSV/XLSX files
3,129 copies of passports or national IDs with PANs
18,629 resumes containing comprehensive personal and employment history.
Security Risks: The leak heightens the risk of identity theft, fraud, and social engineering attacks against job seekers. Cybercriminals could exploit this data for various scams, such as fake recruitment offers and financial fraud.
Lack of Response: Despite multiple attempts to alert Xobin, the exposure went unaddressed for months, raising concerns about cybersecurity practices.
Recommendations for Job Seekers:
Enable multi-factor authentication (MFA) on key accounts.
Monitor financial and credit reports for unusual activity.
Avoid clicking on suspicious links or responding to unexpected messages requesting sensitive actions.
Preventative Measures for Companies:
Limit access to sensitive cloud storage.
Enable encryption for both data at rest and in transit.
Conduct regular security audits.
Implement best practices in data management and compliance with security frameworks.
This incident underscores the importance of strict cybersecurity practices, especially in cloud storage, to protect sensitive user data.
