Taiwan's 104 Job Bank: outsiders read 120,000 résumés through its app

Taiwan's largest job site, 104 Job Bank, says outsiders read about 120,000 job seekers' résumés through its mobile app. Its operator, 104 Corporation, disclosed the incident to the Taiwan Stock Exchange on the evening of October 6, describing it as "abnormal reading" of data in the app system. The next day Taiwan's Ministry of Labor and the New Taipei City government launched administrative oversight under the Personal Data Protection Act, the Central News Agency (CNA) reported.

What is known

104 says that once it noticed the problem it blocked the access, hired an outside security firm for a forensic investigation, informed the regulators and planned to report the case to the Ministry of Justice Investigation Bureau's Taipei office. Affected members are being told by email, and according to the Labor Ministry a written notice will follow. 104 has not said how the attackers got in, over what period, or exactly which fields of the résumés they saw. Taiwanese tech outlet Business Next says the leaked records may include names, phone numbers, emails, education, work history and job preferences, but the company has not confirmed which of these were exposed.

What the regulators can do

According to CNA, the company must take emergency measures, investigate, notify the people affected and report to the New Taipei City authorities within 72 hours. If the inspection finds that 104 failed to protect the data, the Personal Data Protection Act allows a fine of NT$20,000 to NT$2 million together with an order to fix the problem. If the company does not comply, the fine can be repeated at NT$150,000 to NT$15 million each time. Under the same law, people who suffer damage can claim compensation, but 104 has not announced any compensation plan.

What 104 users should do

A stolen résumé is ideal material for fake recruiters: the scammer already knows your name, your job and what kind of position you are looking for. Business Next lists the basic steps:

• Change your 104 password, and any other password that was the same.
• Trust only 104's official SMS sender codes 66104 and 67104; treat other messages "from 104" as suspicious.
• Limit who can see your contact details in the résumé privacy settings.
• Be wary of job offers that ask for an upfront fee, your ID or bank details, even if the "recruiter" quotes your real work history.