The Guardian has emailed "up to half a million" users of its UK-based Jobs website to tell them that some of their personal data may have been compromised by "a sophisticated and deliberate hack" on Friday night.
A Guardian spokesperson said the site has about 10 million unique users per year, and that "the hack was stopped before it was completed".
"As soon as we were alerted to the fact that there was a problem, we dealt with it, in line with the information commissioner's guidance on data protection," said the spokesperson. "We felt it was important to be transparent and alert our users as soon as possible."
Yesterday , the Guardian put a security notice on its Jobs site, which said: "The supplier who runs the site has identified the manner in which it was hacked and taken steps to prevent a recurrence."
User accounts were not hacked, so there is no need for site users to change their passwords. The compromised data could include the person's name, email address, covering letter and CV, but "we have no reason to believe that any financial or bank data was compromised," said the Guardian's email. Some of the data was up to two years old.
The user data is not held on the web but stored on separate databases run for the Guardian by third parties. In the UK, it is reportedly run by Madgex.
A Guardian technology director said: "We will have final numbers of real users and the type of data in the next few days, once we strip out duplicates, false emails and so on." He said he was unable to provide any technical details of the hack, as these were part of a police investigation by the central e-crime unit at Scotland Yard.
Jobs site user Chris Gittner said that at first he thought the email was a hoax, and "all of this wasn't helped by finding out about it late on Saturday evening when there was no one official around to talk to."
Kate Waugh, a user from Staffordshire, said: "I'm quite worried about the repercussions of my sensitive data falling into the wrong hands: I've had enough experience already of card fraudsters so I know how easily you can fall victim to these things.
"I'm going to take the steps recommended by the Guardian, but it's one more worry I could do without. I have to say the Guardian's reassurance that it won't happen again doesn't help."
The Guardian's email passed on police recommendations for "precautionary measures" such as contacting a credit reference agency - Callcredit, Equifax or Experian — and using Cifas, the UK's fraud prevention service . Cifas also runs fraudjobsite.co.uk.
Another user, Simon Anthony, said "we probably will" register with Cifas but "it costs £12 each person. Will the Guardian pay for this?" He said he objected to paying for security that he should not need.
Job sites are regularly attacked by hackers and via email "phishing" attacks, as they provide a rich source of data for those interested in identity theft. Job seekers who simply circulate their CVs directly to potential employers, or post them on the web or on Facebook, are also increasing their level of risk. Job sites may still be the safer option.
The Guardian's US-based Jobs site was not affected.
