Since February, there have been mandatory data breach notification laws in place requiring businesses and agencies covered by the Privacy Act to tell people if they have been affected by a data breach.
Within the past few days, drinks brand Asahi, department stores David Jones and Myer, and investment bank Macquarie, have temporarily halted their jobs pages after recruitment provider PageUp detected “unusual activity” in May that may have compromised some client data.
The ABC is among a number of brands to pull its jobs ads.
In the aftermath of the announcement on Tuesday, it was revealed major Australian universities, AusPost, Coles, Telstra, Commonwealth Bank, Lindt, Aldi, NAB, Medibank and the Reserve Bank of Australia were all affected. The breach is being investigated by the government’s Cyber Security Centre.
PageUp said there was no evidence of an ongoing threat and the jobs website could continue to be used.
However, since late last week, a host of other companies using PageUp’s services have decided to drop their jobs pages until more information is available.
Since February, there have been mandatory data breach notification laws in place requiring businesses and agencies covered by the Privacy Act to tell people if they have been affected by a data breach.
The Australian Broadcasting Corporation has put up a notice on its careers site saying its system has been suspended until there is more information about the nature and extent of the incident.
“We are working through a new process, separate to PageUp to ensure we can protect candidate data,” the site says.
“As soon as this is operational, we will resume advertising vacant roles. In the meantime we cannot accept any applications.”
Bankwest’s page says applications are “closed” until it can be assured PageUp’s systems are safe, while both major department stores Myer and David Jones say they have taken the “precautionary” measure of closing its jobs pages.
Local government pages including the City of Yarra, City of Monash, Mitchell Shire Council and the City of Casey were also taking caution, with some redirecting applicants to jobs listing portal Seek. The Tasmanian government put recruitment on hold.
Major universities hit by data breach affecting thousands of job applicants at top firms
An announcement from Jetstar said PageUp was its recruitment technology provider prior to May 24, but it has now been replaced with Workday.
Women’s fashion retail brand Suzanne Grae alerted applicants, saying it was “working closely with PageUp” to understand the impact, if any, on its data.
Similar notices were put up in the past week by media company Seven West Media, jeweller Michael Hill, electricity provider Powerlink, compensation claims management company Employers Mutual Limited, power company Stanwell, currency management service provider Armaguard, construction materials provider Boral and food manufacturer Simplot.
BP, which uses the PageUp system, has closed its jobs page and said it was managing its recruitment needs offline.
Notices were put up online by South Australian convenience chain On The Run, ASX-listed Downer Group, facilities managers Ventia, Melbourne Water, Queensland Rail, WorkCover Queensland and community services charities such as The Red Cross and Anglicare.
Last week, shopping centre managers Scentre Group, supermarket chain Aldi and Suncorp temporarily shut down PageUp-backed jobs pages.
Waste solutions company Cleanaway and rail freight operator Aurizon put notices on its page about the breach, as did infrastructure and mining group CIMIC and mining services provider Thiess, which both encouraged job hunters to apply through SEEK and LinkedIn.
PageUp has been contacted for comment.
(Source: Sydney Morning Herald, 11 June 2018)
