NJ talent firm exposed thousands of resumes, detailing immigration statuses and security clearances – TechCrunch

A New Jersey expertise acquisition agency uncovered the resumes and private info of at the least 30,000 potential employees by leaving a database on the web with out a password.

The database belongs to Voto Consulting, a North Brunswick firm that finds U.S. jobs largely for Indian IT professionals.

It’s not identified for precisely how lengthy the database was uncovered, however it was first listed by Shodan, a search engine for uncovered gadgets and databases, on Could 10. The database was found by Anand Prakash, a safety researcher and founding father of PingSafe AI, who supplied particulars of the database to TechCrunch.

However as a result of the database was uncovered to the web with out a password, it was attainable for anybody to look the database from an internet browser.

The database contained names, e-mail addresses, and candidates’ resumes — lots of which contained detailed work histories, in addition to different private info, like residence addresses, telephone numbers, and dates of delivery. In lots of instances, resumes additionally revealed candidates’ immigration statuses, resembling if that they had a visa, work authorizations, or citizenship, in addition to particulars of an individual’s safety clearances required for some U.S. federal authorities jobs. Though the existence of a safety clearance is probably not essentially a secret in itself, international governments have lengthy sought to use  and blackmail these with safety clearances for intelligence beneficial properties.

TechCrunch contacted Voto chief govt Lynel Fernandes with a hyperlink to the uncovered database on Could 11, however we didn’t hear again nor did the corporate instantly safe the database. (One message despatched with an open tracker confirmed our e-mail was opened a number of occasions however ignored.)

After not listening to again, TechCrunch notified the New Jersey Cybersecurity and Communications Integration Cell, a state authorities company tasked with cybersecurity info sharing and incident reporting, which agreed to inform Voto by e-mail and telephone in regards to the uncovered database.

The database has been offline since Tuesday, greater than two weeks later. On the time the database was secured, it had grown in dimension by greater than five-fold, itemizing greater than 170,000 entries in whole.

Learn extra: