Trojan trawls recruitment sites in ID harvesting scam

UK as well

I uploaded my CV to monster.co.uk and had is a a private view only. Within a week the amount of spam targeted to my name/email combo on the CV had quadrupled. As they state - they are not responsible for any of your private data that you upload to them.

I wrote to monster about it and their response was:

"We understand that this type of communication may be frustrating, especially as the opportunity that the company is offering may not be something in which you are interested. However, we would like to reassure you that Monster takes all instances of “blanket mailing” or spam very seriously. We are always ready to take action against users who do not comply with our stated guidelines.

While we cannot guarantee that third parties will gain unauthorized access, we do attempt to limit access to our searchable resume database to employers, recruiters, hiring managers, headhunters, and human resource professionals. As delineated in Monster’s Privacy Statement (http://about.monster.co.uk/privacy/), we are not responsible for the use made of resumes by third parties who access such resumes while they are in our searchable database."

They also asked for me to provide the headers for the emails. (a little silly assuming that the spam was probably sent via some form of abstraction - say a botnet.)

I think its time for there to be some thinking about how companies that hold large quantities of data on individuals behave. Most seem to be pretty complacent.

Might be better...

Hackers will probably do a better task of matching you to a job than the useless job agencies out there.

Monster response! (@"UK as well")

>"While we cannot guarantee that third parties will gain unauthorized access, [ ... ]"

... you'd better bloody plan on it because our security SUCKS!

;-)

“While we cannot guarantee that third parties will gain unauthorized access”

Monster, tie a 'not in it.

Monster not taking it seriously enough

A couple of months back I had a unique email address harvested from Monster and subsequently used by the RockPhish enterprise to tout money-laudering roles (typically "Green Tree" spam). When I contacted Monster, they took many days to respond, and did not seem to acknowledge the seriousness of my allegation that my *monster-unique* address had been harvested, and just gave a fairly bland cut-and-paste reply.

In the past couple of days I've had a new deluge of phoney-Monster mailings to a more generic email addy. I haven't yet established whether there's a real link between these and Monster-harvested data, or whther it's just a 'lucky try'...

Sue 'em?

I sued TD Ameritrade for violating their privacy policy, in failing to prevent their customer database from being obtained by hackers. It is a more serious case; they've already offered $1.9MM in plaintiff's attorney's fees alone to settle the case.

It's much harder for Monster to keep crooks out of its database than AMTD... How would monster do so? I.e. how would it differentiate between a faux firm set up to look like a normal company looking for staff, and a real one? Reliably? At reasonable cost?