Hacker claims breach of 50,000 accounts from Wall Street IT recruiting firm

Data dump exposes names, addresses, salary info on job candidates

A hacker today claimed to have broken into ITWallStreet.com, a website for IT professionals seeking jobs or working with Wall Street firms, and exposed highly detailed data belonging to tens of thousands of job applicants.

As many as 12 data files containing detailed information on job applicants were publicly posted today after apparently being accessed from an ITWallStreet database by a hacker belonging to a group called TeamGhostShell.

A Computerworld inspection of the published data showed the first and last names, mailing addresses, email addresses, usernames, hashed passwords and phone numbers of what appear to be thousands of people who have applied for IT jobs with Wall Street firms. Many of the thousands of hashed passwords appear to have already been decrypted into their clear text form.

The data dump included details such as salary and bonus expectations of the job seekers and even feedback on specific candidates. One of the published files, for instance, contained snippets of email exchanges presumably between recruiters and account managers discussing the viability of certain candidates for specific jobs.

Another file contained thousands of phone call records apparently between recruiters and candidates, containing details such as the phone number dialed, the time, date and duration of the call. One contained a list of references apparently supplied by the job candidates.

The salary expectations of job candidates ranged from $40,000 to more than $400,000 suggesting that ITWallStreet's breached resume database included everyone from entry-level IT professionals to senior technology executives. In fact, several of the published email exchanges referred to candidates who appeared to have applied for vice-president level positions at Wall Street firms.

One of the published files contained a detailed listing of what appeared to be hundreds of clients of ITWallStreet.com. The list contains virtually every major Wall Street firm including Morgan Stanley, Goldman Sachs, Nasdaq, Dow Jones, Moody's and Wachovia Bank.

Andiamo Partners, the New York-based recruiting firm that operates the website did not confirm or deny the breach. A spokeswoman said the company would respond later, presumably after verifying the claims. It was not immediately possible to confirm if any of the posted data came from the company's database or pertained to IT job applicants as claimed by the hacker.

It was also difficult to immediately verify how many people may have been affected by the breach. According to "Masakaki," the hacker who claimed credit for the breach, more than 50,000 accounts pertaining to "current, past, and rejected IT personal (sic) from Wall Street" have been compromised. Masakaki claimed to have more than 3,000 resumes "to trade them on the black market."

In a statement announcing the breach, Masakaki suggested the attack was meant as a show of support for the Occupy Wall Street movement. The hacker claimed to belong to "MidasBank," a group that is part of TeamGhostShell, according to the statement.

"GhostShell has been leaking left and right all kinds of targets, well we're here to bring some sort of order to it which is why this district will function solely to provide leaks from an economical point of view," the statement noted. "What better target to pick as a first release, than the place that puts all markets to shame in the world. Wall Street. IT Wall Street owned," the statement read.

According to Andiamo's website, the firm is the leading technology recruiting firm for the financial services sector. The company helps Wall Street firms find IT staff in areas such as development, infrastructure, database and process management.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed. His e-mail address is jvijayan@computerworld.com.

See more by Jaikumar Vijayan on Computerworld.com.

Read more about security in Computerworld's Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.
Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jaikumar Vijayan

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place