Hello,
Willem here again, co-founder and CEO of Homerun. On October 29th, I contacted you or one of your team members about the cyberattack on Homerun and I promised to let you know when we had an update.
Since my last message, our team has been working around the clock doing everything in our power to do right by all customers and candidates whose data may have been affected.
The stolen data has not been made public to the best of our knowledge, and we do not expect this to happen as we've made an agreement with the cyber attacker. Our objective has been - and continues to be - to minimize the impact on you and your candidates.
What's new:- We completed the comprehensive forensic investigation alongside Northwave, the cyber security company we've been working with. This provided us with more details about the attack, the data that was affected and the measures we are implementing to keep this from happening in the future. The Q&A at the end of this email dives deeper into these findings.
- We've been in touch with the DPA (Dutch Data Protection Authority - Autoriteit Persoonsgegevens) and notified them about the cyberattack and the affected data of which we are the controller. We've also filed a complaint with the police.
- The DPA asked us to relay to our customers that you are advised to notify the DPA about the compromised data of which you are the controller (candidate data) and to inform your candidates of the cyberattack.
- For more information on how to notify the DPA, have a look on their website or reach out to them directly by phone. If you decide to notify candidates, we've created a page where you can download the contact information of your candidates who were in your account at the time of the cyberattack. We've also created a dedicated page with more information and FAQ that you can share with your candidates directly.
- Moving forward, we want to further support you in handling your candidate data with care. Over the years we've built features and written content that can help you do this: What GDPR means for hiring: Simply explained, How to be GDPR compliant with Homerun, The GDPR hiring guide and Help Center articles about Homerun and GDPR.
I co-founded Homerun 7 years ago because we wanted to improve the experience for candidates applying to jobs. A part of this has been making it easy for small companies to handle their candidate's data with care. We've always committed ourselves to privacy best practices. However, following this cyberattack, we see an opportunity to take an even more radical standpoint in this by embedding more privacy principles (for example, more opt-out and less opt-in privacy settings) and giving more control to job applicants over their data.
For any questions you might still have, please have a look at the Q&A below which contains what we've learned from our forensic investigation. Lastly, thanks for your support – it really means a lot to me and the entire Homerun team.
Willem van Roosmalen
CEO of Homerun
Q&A:
In collaboration with Northwave we’ve put together this Q&A that dives deeper into the findings of the comprehensive forensic investigation and provides answers to other questions you might have.
What was the nature of the cyberattack?
A cyber attacker accessed our systems on October 20th and made a copy of a number of files from our data storage. They were unable to delete or alter the data due to security measures we had in place. They simply copied it. We discovered this on the 26th and on the 28th the vulnerability was patched.
We host our infrastructure on Amazon Web Services. Part of this infrastructure includes running web servers using a popular software package called Apache HTTP Server. At the moment of the incident, a vulnerability existed in that particular software (CVE-2021-40438) that allowed an attacker to access internal AWS metadata and steal access tokens. Those tokens were used later on to access our data storage which contains the data categories listed in the next question.
What personal data can we confirm has been affected?
The data storage that was affected in the cyberattack contained the following data categories:
- Candidate data: This includes any information that candidates have shared with you in job applications like CVs, portfolios, pictures, assignments and answers to your apply form questions. If the candidate data was deleted before the 13th of October, we can say for sure that it was not affected.
- Job posts and career pages: These are or have already been public, but we mention them because they may include personal data like photos and names of your team. This also includes any private jobs you have published.
- Profile images of Homerun users and team notes. Team notes have only been affected if you have requested a manual export via our support team of your account within the last 90 days before the cyberattack. This includes sensitive notes (notes that only certain users have access to).
We realize you may want to know more about what data of yours has been affected exactly, but the investigation was not able to provide us with more specificity than what we're sharing with you here.
We can still say with full certainty that your payment information like credit card details were not affected. Also, our systems were not affected by ransomware. Therefore, Homerun has been - and still is - up and running and safe for you to use.
According to the GDPR I need to notify the Dutch Data Protection Authority within 72 hours after being informed of the cyberattack. I'm too late, what do I do?
The 72 hours began when you received the first notification we sent you about the cyberattack. It's best to reach out to the Dutch Data Protection Authority or your legal adviser about what's best for you to do now.
How do I know which candidates may have been affected by this?
All the candidates present in the "All candidates" page that applied before the 20th of October, may have been affected in this cyberattack. You can create an export with the contact information of those candidates here.
What security measures were in place at the time of the attack?
Northwave often sees similar kinds of compromises. This is usually because settings are not configured correctly. In the case of Homerun, Northwave investigated the configuration settings and determined that they were configured to industry best practices. Northwave determined that the cyber attacker was never able to delete the data because the settings blocked that.
More generally, at Homerun we use AWS as a cloud infrastructure provider, with the following security measures implemented:
- Everyone in our tech team must have activated MFA to be able to log into our management console.
- Network services that provide access to the personal data are secured by firewalls with a default-deny setting.
- Network transmissions of Personal Data are encrypted with Transport Layer Security.
- All access to Personal Data is authenticated by a username and password or is secured by AWS key access.
What measures have been put in place to fix this issue?
Upon discovery, we immediately fixed the vulnerability by upgrading Apache HTTP Server software on all running servers. Northwave has checked and confirmed that this fix is effective against similar attacks.
/u/30977/crop654a08a5866a6_cropped.png?f=community)
:strip_icc():strip_exif()/u/8430/logo.jpg?f=community){kind=logo}
:strip_icc():strip_exif()/u/457808/crop5686a95ab9c87_cropped.jpeg?f=community)
En Q42 is voor jou de verantwoordelijke. Zowel wettelijk als ethisch. Uit eigen ervaring zullen ze waarschijnlijk iets gaan blaten dat ze Homerun (vrij bekend platform voor recruiting) gebruiken.:strip_icc():strip_exif()/u/582818/crop623490e658426_cropped.jpg?f=community)
/u/28468/librarian2.png?f=community)
/u/74211/crop5db297afbbd2b_cropped.png?f=community)
:strip_exif()/u/53157/thai4.gif?f=community)
:strip_icc():strip_exif()/u/549157/crop614c74a1a13ab_cropped.jpg?f=community)
:strip_exif()/u/122790/ava.gif?f=community)
/u/38159/DirkJan.png?f=community)
/u/30789/crop6066c9ef8cc2a_cropped.png?f=community)
:strip_icc():strip_exif()/u/381737/crop65fd38b42fa8d_cropped.jpg?f=community)
?:strip_icc():strip_exif()/u/155904/crop5ab030145f248_cropped.jpeg?f=community)
:strip_icc():strip_exif()/u/210110/crop5cb20f9251261_cropped.jpeg?f=community)
/u/466919/Tweakers_p9_v2.png?f=community)
:strip_icc():strip_exif()/u/124672/avatar.jpg?f=community){kind=avatar}