Security Experts:

Connect with us

Hi, what are you looking for?



Staffing Firm Robert Half Says Hackers Targeted Over 1,000 Customer Accounts

HR consulting firm Robert Half has started informing customers that their personal and financial information might have been compromised after hackers targeted their accounts.

HR consulting firm Robert Half has started informing customers that their personal and financial information might have been compromised after hackers targeted their accounts.

Information provided by the company to the Maine Attorney General shows that threat actors targeted Robert Half between April 26 and May 16. The incident, discovered on May 31, impacts 1,058 individuals.

“We recently identified suspicious login activity on your account that occurred in late April/early May 2022. Upon detection, we required you to reset your account password, and we took steps to strengthen authentication controls for the website,” the company said in a cybersecurity incident notice sent to impacted individuals.

The targeted accounts store information such as name, address, and social security number, as well as wage and tax information. The company noted that bank account numbers for direct deposits are stored in these accounts, but only the last four digits are visible.

“While we do not have evidence that this information was actually accessed or downloaded, in the interest of transparency we wanted to inform you about this incident and provide you with the information in this letter,” Robert Half said.

The company has not shared any additional information, but based on its brief description the incident appears to involve credential stuffing, where attackers take usernames and passwords stolen in previous data breaches and attempt to use those credentials to access accounts on other online services where the victim may have used the same username and password combination.

Robert Half’s customer notification also advises recipients to change their passwords on other accounts where the same credentials have been used. In addition, it includes other password management recommendations, which also suggest this was a credential stuffing attack.

SecurityWeek has reached out to Robert Half for clarifications, but the company has not responded so it’s unclear if the incident also involved an actual breach of its systems.

The staffing firm is offering impacted individuals two years of free identity monitoring services through Experian.

It’s not uncommon for major companies to be targeted in credential stuffing attacks. One recent victim is carmaker GM, which informed customers in May that cybercriminals had attempted to access their accounts in an effort to redeem reward points for gift cards.

Related: LastPass Automated Warnings Linked to ‘Credential Stuffing’ Attack

Related: NY AG: Credential Stuffing Impacts 1.1 Million Users at 17 Companies

Related: FBI: Higher Education Credentials Sold on Cybercrime Forums

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.


Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack


CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.


Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.


Artificial intelligence is competing in another endeavor once limited to humans — creating propaganda and disinformation.