The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →ResumeLooters was a cybercrime campaign against recruitment and job-search websites, not primarily an attack on job seekers’ personal computers. Group-IB’s 2024 report counted 2,188,444 rows in stolen files and 510,259 user records attributed to job-search websites; neither figure establishes how many unique people were affected. The report identified 65 compromised websites, mostly in APAC, but it does not reveal whether any particular person’s résumé was among the stolen data.
What is ResumeLooters?
ResumeLooters is the name Group-IB gave to a previously unknown cybercrime group that targeted employment agencies and retail companies, with a focus on job-search platforms and résumé theft. Group-IB said it detected the campaign in November 2023 and identified 65 compromised websites between November and December 2023. File creation dates on attacker infrastructure led the researchers to trace the earliest observed attacks to the beginning of 2023. These are findings from Group-IB’s 2024 incident analysis, not a current tally of active attacks. Group-IB’s report
How many resumes did ResumeLooters steal?
Group-IB’s 2024 report counted 2,188,444 rows in stolen files and separately reported 510,259 user records from job-search websites. Those figures describe different units: the first is a total row count across stolen files, while the second is the report’s job-search-site user-data subset. Group-IB did not establish that each row or record represents a different person, so neither number should be presented as a unique-person count. The report also does not establish that every affected website’s full database was taken or that every record was sold.
Group-IB said stolen data was advertised for sale in Telegram channels. Advertising data for sale does not show that every record was purchased or distributed.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
What information did ResumeLooters steal?
Group-IB said databases targeted by SQL injection could contain names, phone numbers, email addresses, dates of birth, employment experience, employment history, and other sensitive personal data. The precise fields at risk depended on what each website stored; the report does not say that every compromised site exposed every listed field.
How did SQL injection and XSS affect job sites?
| Method | Role in the campaign | What it could mean |
|---|---|---|
| SQL injection | Used to retrieve website databases. | Could expose stored user information, including contact details and employment history. |
| Cross-site scripting (XSS) | Scripts were injected into legitimate job-search websites to load additional malicious code and display phishing forms. | Visitors could encounter phishing behavior through a legitimate site. Group-IB found evidence of execution on some visitors’ devices, but said a script’s presence did not prove it executed on every device. |
The two techniques served different purposes: SQL injection targeted stored data, while XSS could affect a site’s content as viewed by visitors. The campaign’s primary target was the websites and their data, rather than job seekers’ computers as the initial entry point.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
Where were the victims?
Group-IB reported that over 70% of known victims were in APAC. In its 2024 findings, the researchers identified 12 victims in India, 10 in Taiwan, 9 in Thailand, and 7 in Vietnam. They also found compromised companies in Brazil, the United States, Turkey, Russia, Mexico, Italy, and elsewhere. These figures reflect victims identified by the researchers, not a complete census of all affected organizations.
Group-IB observed Chinese-language Telegram accounts and tools, but said these clues did not establish the operators’ nationality, location, or sponsorship. The report does not support attributing the campaign to a government or claiming a definite national origin.
Was my resume stolen in the ResumeLooters attack?
The public Group-IB report does not identify whether a particular person’s résumé or account was included, and it does not provide an individual exposure checker. A person’s presence on a job-search website is not, on its own, proof of exposure. Check for a notice from the specific platform you used and follow its instructions; the report’s aggregate counts cannot confirm individual impact.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should job seekers handle possible breach messages?
A message claiming to notify you about a breach can itself be a phishing lure. CNIL’s March 13, 2024 guidance after a separate France Travail breach recommends watching for urgent SMS and emails, not sending passwords or banking details by message, avoiding suspicious attachments and login links, going directly to the official service site, monitoring account activity, and using robust passwords. This was guidance for the France Travail case, not advice issued specifically for ResumeLooters. CNIL’s guidance
Quick Recap
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
