A Sydney law firm is seeking potential victims for a class action after PageUp, a multinational software provider used by some of Australia’s biggest companies to manage their recruitment, notified that it had been hacked.
Thousands of job applicants’ personal details may have been compromised in the data breach. The software is used by many large companies and agencies including Telstra, Wesfarmers, Linfox, the Reserve Bank, and the ABC to manage job applications via an online process.
The information included in job applications would be extremely useful for identity fraud. As well as birth dates and other identifying details, job applications could potentially include passport details, tax file numbers and bank accounts.
Sign up to receive the top stories in Australia every day at noon
Several large corporates and government agencies that rely on PageUp People have now suspended their recruitment sites as they await for answers on what, if anything, was compromised.
PageUp, which boasts 2 million active users across 190 countries, posted a statement from chief executive Karen Cariss on its website, saying it had noticed “unusual activity” in its IT infrastructure on May 23.
The company has launched an investigation, while its client companies also released emergency statements to their employees and candidates who had applied for jobs using PageUp’s software.
“We have suspended all connections between Coles’ systems and PageUp’s systems and stopped all available points of upload, while we obtain information from PageUp about the nature and extent of the security incident and possible data breach,” Coles said in an advisory to staff.
The list of companies includes:
- Wesfarmers: Coles, Target, Kmart, Officeworks
- NAB
- Telstra
- Commonwealth Bank
- Lindt
- Aldi
- Linfox
- Reserve Bank of Australia
- Australia Post
- Medibank
- ABC
- Australian Red Cross
- University of Tasmania
- AGL
- Jetstar
PageUp’s company statement said it had notified the Australian Cyber Security Centre (ACSC) and engaged with Australia’s Computer Emergency Response Team and equivalent United Kingdom authorities.
Head of the ACSC Alastair MacGibbon said the centre was working with PageUp to investigate the security breach.
“There has been a breach, there has been malicious code executed inside PageUp’s systems and criminals may have access to an amount of documentation, we just don’t know exactly what it is,” Mr MacGibbon said.
“Any breach is bad and our job in the government is to reduce the likelihood of these events happening, but unfortunately the reality is that criminal groups are always looking at new ways to steal credentials and wreak havoc on our society.”
Mr MacGibbon recommended any PageUp users change their passwords.
The principal solicitor of Centennial Lawyers, George Newhouse, said employers owed a duty to keep highly personal information confidential, not only of their workers but also those that are applying for work.
This can often include financial information and even medical information required as part of an induction process he said.
“Companies, and those that provide services to them, must take adequate steps to protect their employees’ or potential employees’ information. This case highlights the damage that can be done if security is breached,” he said.
