How the My Next Move Breach Exposed 217 Government Career Portal Users in Plaintext

In October 2024, My Next Move, a career exploration tool operated under the U.S. Department of Labor at mynextmove.org, suffered a database compromise that exposed the personal details of 217 users. The leaked data included email addresses, first and last names, phone numbers, and most critically, plaintext passwords. That last detail is the most alarming: plaintext passwords mean the credentials were stored without any encryption or hashing whatsoever, a fundamental failure in secure development practice. Anyone with the dumped file can log in immediately without needing to crack anything.

Why This Is Dangerous

Government-affiliated platforms carry an implicit level of trust. Users who register on mynextmove.org may reuse the same password across more sensitive accounts, including federal benefits portals, email, or banking, precisely because they trust a Department of Labor domain to handle their data responsibly. Plaintext password storage eliminates even the minimal protection that hashing would provide and hands attackers a fully operational credential list from the moment the data is stolen.

What Was Exposed

• Email addresses (217 records)
• First names and last names
• Phone numbers
• Plaintext passwords (unencrypted, immediately usable)

Why This Matters

Even a small breach of 217 records carries serious consequences for each affected person:

• Credential stuffing: Plaintext passwords paired with email addresses are immediately tested against other platforms. Bank accounts, email inboxes, and social media are common targets.
• Account takeover: Control of a victim's email account allows an attacker to reset passwords on every linked service, escalating access rapidly.
• Identity theft: Full name, email, and phone number together enable attackers to impersonate victims, register accounts in their name, or pass SMS-based identity verification.
• Fraud: Phone numbers in the dataset open the door to SIM swapping, a technique where attackers convince a carrier to transfer a victim's phone number, bypassing SMS two-factor authentication.

How the My Next Move Breach Happened

My Next Move is a career exploration resource hosted at mynextmove.org, providing job seekers with occupational data from the O*NET database. The breach, dated October 1, 2024, involved unauthorized access to the platform's user database. The presence of plaintext passwords in the exported data indicates that the application was storing user credentials without encryption at the database layer. This is a violation of basic secure coding standards and suggests either legacy infrastructure, a misconfiguration, or a deliberate shortcut in the development process. The breach classified as a database compromise, meaning the attacker obtained direct read access to the underlying data store rather than intercepting traffic or exploiting application-layer vulnerabilities.

Check If You Are Affected

HEROIC's breach database contains over 400 billion compromised records indexed from thousands of known incidents. If you have ever registered on My Next Move or used the same email and password combination elsewhere, search now to see if your credentials have been exposed. Change your password immediately on any platform where you used the same one, and enable two-factor authentication wherever it is available.