Hundreds of thousands of people, mostly in the U.S., have been exposed to the risk of file ransom after the Web site of the world's largest online recruiter was hacked.
Personal details stored on Monster.com, a Web site that lists job seekers and job opportunities, were taken after a raid by hackers who posed as employers to gain access to the site.
Having stolen the information, hackers e-mailed the victims claiming to have infected their computers with a virus and threatening to delete files unless demands for payment were met.
In all, more than 1.6 million entries in Monster's system — belonging to "several hundred thousand" members — were taken after the hackers logged in using the details of employers who routinely scour the site for prospective workers, according to the Silicon Valley security firm Symantec.
The information, which included first and last names, e-mail and home addresses and phone numbers, was then used to send "phishing" e-mails to members, apparently from Monster.com, encouraging them to download a tool known as "Monster Job Seeker."
The tool was in fact a malicious program known as a "Trojan," as in Trojan horse, which encrypted files on the victims' machines, making them inaccessible to the computer owner.
A message was left requesting that money be paid to the attackers before the files — which could include photos and other personal documents — would be decrypted.
"We're still investigating — we don't yet know how this information was obtained, other than that it was downloaded using the login details of legitimate customers of ours," said Patrick W. Manzo, vice president for fraud prevention at Monster.com. "It seems likely it was done over a period of time, because we would have noticed such a vast quantity of details being taken all in one go."
A statement from the company said that it would "take all necessary steps to mitigate the issue, including terminating any account used for illegitimate purposes."
Symantec, which first reported the breach, said that "such a large database of personal information" was "a spammer's dream."
"This remote server held over 1.6 million entries with personal information belonging to several hundred thousand candidates, mainly based in the U.S., who had posted their resumes to the Monster.com Web site," a posting on the Symantec blog said.
Symantec said that the e-mails sent to victims appeared very realistic, carrying the official Monster logo and containing personal information that users had posted on the site in their resumes.
The breach was a new twist on a traditional hack used against corporate databases, security experts said, because the attackers stole log-in details of legitimate users of the database — in this case employers — which in turn granted them access to the vast pool of information it contained.
"We are seeing more and more of this extortion-based threat, and in some cases hackers are demanding victims pay up or face a file being deleted from their machine every half hour," said Graham Cluley, a security expert at Sophos, a British security firm.
Symantec advised users of recruitment sites to limit the personal information they posted, and to use a separate, disposable e-mail address rather than their main personal account. Users who feared they may have been affected were encouraged to contact a security vendor and have their machine examined.
Monster.com, based in New York, claims to the be the world's largest online jobs listing site, with 73 million resumes held globally.