SHINDO4

doda

PERSOL CAREER CO., LTD.

Personal data49,486people

LEAK CONFIRMEDSoftware defect · Contained

Open in the live monitor ▶
Disclosed
Feb 5, 2025
Leak
Leak confirmed
Type
Software defect
Status
Contained
Security spend
Not checked yet
Compensation
Not announced

What leaked

UnspecifiedJob seeker information (job seeker detail page)

How many

  • Job seekers whose data was viewable 49,486 people
  • Job seekers whose detail page was actually viewed by blocked companies 1,763 people

Who is affected

  • doda scout service users (job seekers)

Cause

A bug automatically lifted users' preset company block settings when they started using the scout service, so blocked companies could view their profiles and even send scout emails

Timeline

  1. Date of the Security NEXT report

What you should do

  1. Check the company's notice to see if you're affected

Lessons for companies

  1. Never sit on a known defect. Test every change before production
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources