PageUp malware highlights risks for third parties
Human resource firm PageUp warned customers its backend infrastructure was infected with malware and as a result, customers' information such as names, contacts and passwords may have been hacked. A week after the announcement of the malware, on June 12, PageUp stated that after extensive review, it now knows that personal data relating to clients, applicants, references and employees has been accessed by a hacker.
PageUp has released a statement that "based on our current information we believe the affected data may include names, street addresses, email addresses, and telephone numbers." Some employee usernames and passwords may have been accessed, but current password data is protected using industry best practice techniques including hashing and salting, and is considered to be of very low risk to individuals, according to PageUp's statements.
PageUp stated that no employment contracts, applicant resumes, Australian tax file numbers, credit card information or bank account information were affected. No data pertaining to its Onboarding, Performance, Learning, Compensation or Succession Modules was affected. PageUp have since deployed several layers of advanced security monitoring solutions, which have not identified any ongoing malicious activity. PageUp is confident that the threat has been contained and disinfected. They also feel that the additional security measures will help prevent other incidents in the future.
PageUp provides recruitment and unified talent management software for several companies. The security incident left many of these customers, including banks and universities, scrambling to notify their own end users. It serves as another reminder that third party software and services are susceptible to dangerous security breaches impacting customers downstream. After detecting unusual activity on its IT infrastructure on May 23, PageUp stated that it found indicators that client data may have been compromised. That included names and contact details, such as usernames and encrypted passwords.
While a forensic investigation with assistance from an independent third party is currently ongoing, there is no evidence that there is still an active threat, and the jobs website can continue to be used. All client user and candidate passwords in the database are hashed using bcrypt and salted, but to be on the safe side, PageUp suggest users change their password.
Malware targeting third party systems has been an easy way for hackers to access enterprise and customer data. This has been true with malware targeting point of sale systems to breach restaurant customer data, including an incident involving Applebee's in March, as well as malware targeting third party HVAC systems to breach retail store data, including the Target breach. Unless something changes, this trend of third party attacks will continue to get worse. From Target to the SWIFT Network, there have been high profile third party attacks for a long time and new one pop up almost weekly. The interconnected nature of our digital world is great for facilitating the flow of business, but unfortunately there's a flip side. It makes it easier for hackers to find soft spots to access our data. It's become the path of least resistance and there are no reasons why hackers would stop now when they're having so much success.