Jobandtalent jobandtalent.com Jobandtalent data breach: what happened and what to do
In about February 2018 the employment website Jobandtalent had a data breach that exposed 11 million subscribers' names, email addresses, IP addresses and passwords stored as salted SHA-1 hashes. It surfaced for sale a year later.
View all 13,115 breaches- Breach date
- Feb 2018
- Affected
- 10,981,207
- Data exposed
- Email addresses, IP addresses, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Jobandtalent, a Spanish employment website, had a data breach that Have I Been Pwned (HIBP) dates to about February 2018. It counts about 11 million accounts.
What happened
The data appeared for sale alongside other breaches a year later. Spanish coverage in July 2018 said the company reported that an outside platform had accessed its server, that it reset user passwords and that it reported the incident to the data protection agency. Spain's national cybersecurity institute INCIBE reported the same details. Those sources give a different date from HIBP's, so the start is best described as 2018.
What was exposed
Names, email addresses, IP addresses and passwords stored as salted SHA-1 hashes. Salting makes cracking harder than unsalted hashes, but SHA-1 is still weak.
What it means for you
There was no phone number or address in the data, so the main risks are password reuse and phishing that pretends to be a job offer or recruiter. Use a new password wherever you reused your old one.
How to check your exposure
Search your email address on Have I Been Pwned, which holds this dataset and lets you look up an address for free. If it appears, change the password on every account that shared it. Then treat unsolicited job offers that mention your name with suspicion, and check the sender before you reply.
What to do if you were in it
- 1
Change your password and turn on 2FA
Set a new, unique password for Jobandtalent. If you used that password anywhere else, change it there too, and turn on two-factor login on your important accounts. A password manager makes unique passwords easy.
- 2
Be careful with job offer messages
Fake recruiters ask for documents or fees. Don't send ID or pay anything to someone who contacted you first, and confirm the company through its official site.
- 3
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about new exposures early. It can't remove data from a breach, which is why the steps above matter.
Frequently asked
Was I affected by the Jobandtalent breach?
Check your email on Have I Been Pwned. If Jobandtalent is listed, you were in the data.
What was exposed?
Names, email addresses, IP addresses and salted SHA-1 password hashes.
Should I change my password?
Yes, on any site where you used your Jobandtalent password.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
