Security Experts:

Connect with us

Hi, what are you looking for?



Staffing Firm Robert Half Says Hackers Targeted Over 1,000 Customer Accounts

HR consulting firm Robert Half has started informing customers that their personal and financial information might have been compromised after hackers targeted their accounts.

HR consulting firm Robert Half has started informing customers that their personal and financial information might have been compromised after hackers targeted their accounts.

Information provided by the company to the Maine Attorney General shows that threat actors targeted Robert Half between April 26 and May 16. The incident, discovered on May 31, impacts 1,058 individuals.

“We recently identified suspicious login activity on your account that occurred in late April/early May 2022. Upon detection, we required you to reset your account password, and we took steps to strengthen authentication controls for the website,” the company said in a cybersecurity incident notice sent to impacted individuals.

The targeted accounts store information such as name, address, and social security number, as well as wage and tax information. The company noted that bank account numbers for direct deposits are stored in these accounts, but only the last four digits are visible.

“While we do not have evidence that this information was actually accessed or downloaded, in the interest of transparency we wanted to inform you about this incident and provide you with the information in this letter,” Robert Half said.

The company has not shared any additional information, but based on its brief description the incident appears to involve credential stuffing, where attackers take usernames and passwords stolen in previous data breaches and attempt to use those credentials to access accounts on other online services where the victim may have used the same username and password combination.

Robert Half’s customer notification also advises recipients to change their passwords on other accounts where the same credentials have been used. In addition, it includes other password management recommendations, which also suggest this was a credential stuffing attack.

SecurityWeek has reached out to Robert Half for clarifications, but the company has not responded so it’s unclear if the incident also involved an actual breach of its systems.

The staffing firm is offering impacted individuals two years of free identity monitoring services through Experian.

It’s not uncommon for major companies to be targeted in credential stuffing attacks. One recent victim is carmaker GM, which informed customers in May that cybercriminals had attempted to access their accounts in an effort to redeem reward points for gift cards.

Related: LastPass Automated Warnings Linked to ‘Credential Stuffing’ Attack

Related: NY AG: Credential Stuffing Impacts 1.1 Million Users at 17 Companies

Related: FBI: Higher Education Credentials Sold on Cybercrime Forums

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.