Software provider used by companies for job applications has been hacked

This article is more than 2 years old

This article is more than 2 years old

A Sydney law firm is seeking potential victims for a class action after PageUp, a multinational software provider used by some of Australia’s biggest companies to manage their recruitment, notified that it had been hacked.



Thousands of job applicants’ personal details may have been compromised in the data breach. The software is used by many large companies and agencies including Telstra, Wesfarmers, Linfox, the Reserve Bank, and the ABC to manage job applications via an online process.

The information included in job applications would be extremely useful for identity fraud. As well as birth dates and other identifying details, job applications could potentially include passport details, tax file numbers and bank accounts.

Sign up to receive the top stories in Australia every day at noon

Several large corporates and government agencies that rely on PageUp People have now suspended their recruitment sites as they await for answers on what, if anything, was compromised.



PageUp, which boasts 2 million active users across 190 countries, posted a statement from chief executive Karen Cariss on its website, saying it had noticed “unusual activity” in its IT infrastructure on May 23.

The company has launched an investigation, while its client companies also released emergency statements to their employees and candidates who had applied for jobs using PageUp’s software.

“We have suspended all connections between Coles’ systems and PageUp’s systems and stopped all available points of upload, while we obtain information from PageUp about the nature and extent of the security incident and possible data breach,” Coles said in an advisory to staff.

The list of companies includes:

Wesfarmers: Coles, Target, Kmart, Officeworks

NAB

Telstra

Commonwealth Bank

Lindt

Aldi

Linfox

Reserve Bank of Australia

Australia Post

Medibank

ABC

Australian Red Cross

University of Tasmania

AGL

Jetstar

PageUp’s company statement said it had notified the Australian Cyber Security Centre (ACSC) and engaged with Australia’s Computer Emergency Response Team and equivalent United Kingdom authorities.

Head of the ACSC Alastair MacGibbon said the centre was working with PageUp to investigate the security breach.

“There has been a breach, there has been malicious code executed inside PageUp’s systems and criminals may have access to an amount of documentation, we just don’t know exactly what it is,” Mr MacGibbon said.

FBI says Russians hacked hundreds of thousands of home and office routers Read more

“Any breach is bad and our job in the government is to reduce the likelihood of these events happening, but unfortunately the reality is that criminal groups are always looking at new ways to steal credentials and wreak havoc on our society.”

Mr MacGibbon recommended any PageUp users change their passwords.

The principal solicitor of Centennial Lawyers, George Newhouse, said employers owed a duty to keep highly personal information confidential, not only of their workers but also those that are applying for work.



This can often include financial information and even medical information required as part of an induction process he said.

“Companies, and those that provide services to them, must take adequate steps to protect their employees’ or potential employees’ information. This case highlights the damage that can be done if security is breached,” he said.