California-based workforce platform leaks drivers licenses and medical records

Prosperix, a US-based workforce management platform, has leaked nearly 250,000 files. The breach exposed job seekers’ sensitive data, including home addresses and phone numbers.

Prosperix, formally Crowdstaffing, calls itself a “workforce innovation” company that develops software solutions for businesses to build an “extraordinary” workforce. It lists KPMG, Walmart, NBCUniversal and Avon among brands that trust the company.

On May 1st, the Cybernews research team discovered a misconfigured Amazon AWS bucket. The misconfiguration led to the exposure of approximately 250,000 files. 42,000 of them contained the sensitive data of job seekers, namely:

• Full names
• Dates of birth
• Occupation history
• Home addresses
• Phone numbers
• Email addresses

According to the researchers, most of these files were employment authorization documents, driving licenses, resumes, filled job application forms, diploma certificates and transcripts. Some of them were medical records – including urine tests and vaccination records.

The issue was quickly solved by the company. Cybernews reached out for an official comment but has yet to receive a reply.

The potential risks

A data leak like this can have many negative consequences for both the company and the affected job seekers.

“Individuals' personal information (PII) such as full names, dates of birth, emails, phone numbers, and home addresses can be exploited for identity theft, spear phishing attacks, and other sorts of fraud,” our researchers warned.

For example, fraudsters could abuse such data to launch sham recruiting agencies. “This would be rather easy as fraudsters would already possess enough information about the potential victims to make their targeted scam look like appealing employment opportunities.”

Most of the employment authorization documents and driving licenses that were exposed appear to be expired. However, the leaky bucket dates back to 2017.

“Its exposure could presumably mean that those documents have been accessible for a considerable amount of time,” researchers warned.

Prosperix should focus on the following areas to mitigate risks:

• Encryption: setting default server-side encryption for existing Amazon S3 buckets.
• Auditing and logging: regularly checking server access logs
• Employee training: enhancing knowledge and awareness of data security.

This isn’t the first time the Cybernews research team has stumbled upon exposed job seeker data. Last year, international job search engine Jooble.org put itself and its clients at risk by leaving a 470GB database unprotected.

The lion's share of the database was composed of different job postings and searchers for companies. Our findings also indicated that Eastern European job seekers were at risk because the leaked data contained their personal information.

Leaks like this put job seekers at risk, so they should educate themselves on how to spot common job search-related scam techniques.

“For example, criminals tend to ask for money, financial information, or detailed personal information early in the application process. They also suggest conducting interviews through social media chats, set up fake company names with little to no social media presence, and offer salaries that are suspiciously high for the role,” they said.

Job seekers should do their homework by attentively looking into the company’s history and online presence. It’s also a good idea to contact the company through official channels.

What to do if you are a job seeker

• Be cautious about the sites you upload your personal identifiable information to
• Make sure the website is secure. The site URL should begin with "https://" rather than "http://"
• Use strong, randomly generated passwords and multifactor authentication
• Don’t click links in emails unless you are confident that the sender is who they claim to be
• Before applying for a position, do extensive research on the company to confirm its existence and validate identifying information