HR consulting firm Robert Half has started informing customers that their personal and financial information might have been compromised after hackers targeted their RobertHalf.com accounts.
Information provided by the company to the Maine Attorney General shows that threat actors targeted Robert Half between April 26 and May 16. The incident, discovered on May 31, impacts 1,058 individuals.
“We recently identified suspicious login activity on your RobertHalf.com account that occurred in late April/early May 2022. Upon detection, we required you to reset your account password, and we took steps to strengthen authentication controls for the website,” the company said in a cybersecurity incident notice sent to impacted individuals.
The targeted accounts store information such as name, address, and social security number, as well as wage and tax information. The company noted that bank account numbers for direct deposits are stored in these accounts, but only the last four digits are visible.
“While we do not have evidence that this information was actually accessed or downloaded, in the interest of transparency we wanted to inform you about this incident and provide you with the information in this letter,” Robert Half said.
The company has not shared any additional information, but based on its brief description the incident appears to involve credential stuffing, where attackers take usernames and passwords stolen in previous data breaches and attempt to use those credentials to access accounts on other online services where the victim may have used the same username and password combination.
Robert Half’s customer notification also advises recipients to change their passwords on other accounts where the same credentials have been used. In addition, it includes other password management recommendations, which also suggest this was a credential stuffing attack.
SecurityWeek has reached out to Robert Half for clarifications, but the company has not responded so it’s unclear if the incident also involved an actual breach of its systems.
The staffing firm is offering impacted individuals two years of free identity monitoring services through Experian.
It’s not uncommon for major companies to be targeted in credential stuffing attacks. One recent victim is carmaker GM, which informed customers in May that cybercriminals had attempted to access their accounts in an effort to redeem reward points for gift cards.
Related: LastPass Automated Warnings Linked to ‘Credential Stuffing’ Attack
Related: NY AG: Credential Stuffing Impacts 1.1 Million Users at 17 Companies
Related: FBI: Higher Education Credentials Sold on Cybercrime Forums
