Welljob

We noticed a recent resurgence of chatter surrounding a dataset originating from August 2018, specifically referencing the French HR and staffing group, Welljob. This particular breach, affecting 8,932 users, has resurfaced on a prominent hacking forum, indicating potential re-packaging or renewed interest from threat actors. What struck us was the relatively low pwned count, suggesting this might be a targeted component of a larger campaign or a dataset that has been circulating within specific communities for some time. The inclusion of email addresses and password hashes, even in an unspecified format, necessitates a thorough review of our internal threat intelligence feeds for any correlating activity.

The Welljob breach, initially discovered in August 2018, involved the exfiltration of 8,932 user records. The compromised data primarily consists of email addresses and password hashes. The exact format of the password hashes remains undisclosed, which presents a significant challenge for direct analysis and necessitates a cautious approach to credential stuffing detection. This incident is categorized as a database breach, likely stemming from a direct compromise of Welljob's internal systems. The fact that this dataset is being re-circulated suggests it may be used as a combolist for further credential stuffing attacks against other services, leveraging the potential for password reuse.

While this specific Welljob breach from 2018 did not garner widespread media attention at the time of its initial discovery, older data breaches often find new life on underground forums. Open-source intelligence (OSINT) searches reveal consistent mentions of Welljob in the context of French staffing and HR services, underscoring the potential value of their user data for malicious actors seeking to exploit professional networks. Research into common attack vectors for HR and staffing firms of this size in the 2018 timeframe often points to vulnerabilities in web application firewalls or unpatched database systems, which could have been the ingress point for this compromise.