Talentsconnect exposes 843 companies' recruitment data and 335 live HR credentials
This digest was compiled by AI from multiple sources — links to the originals are below.
German HR technology firm Talentsconnect left an unauthenticated database exposing nearly 11GB of live recruitment data from 843 companies, Cybernews reported in late June. The exposed data included more than 5 million job listings and 335 plaintext credentials granting access to SmartRecruiters, Workday and SAP SuccessFactors. Talentsconnect closed the database after disclosure, while researchers found no evidence of unauthorized access.
The Exposed Database
Talentsconnect, a Hamburg-based HR technology company, operated a database that lacked authentication and granted full read and write access to nearly 11GB of live recruitment data from 843 companies. Cybernews researchers identified the database in late June and found it was still receiving live production events one week before discovery, indicating it was not a dormant test system. The company closed the database after researchers disclosed the issue, and the information is no longer publicly accessible.
Credential Exposure
Researchers found 335 live credentials stored in plaintext, providing access to platforms such as SmartRecruiters, Workday and SAP SuccessFactors. Exposed AWS Secrets Manager references pointed to vaults for Siemens, Vodafone, Hornbach and ARAG, among other major companies. The read and write access meant anyone on the internet could read client rosters, alter data, inject fake job ads or delete listings, according to Cybernews researchers.
Applicant Data Scope
The leak exposed more than 5 million job listings, including names, email addresses, phone numbers, salary expectations and CVs of applicants, including from Fortune 500 companies. Cybernews researchers found no evidence that unauthorized users accessed the data while it was exposed, but noted that threat actors monitor the internet for such databases and may not leave identifiable traces.
What's Next
Cybernews has reached out to Talentsconnect for a statement and will update its report once the company replies. It remains unclear whether any malicious actor accessed or modified the exposed database before it was closed, and whether affected applicants or companies will be notified.
1 source
Talentsconnect exposes 843 companies' recruitment data and 335 live HR credentials
