'No evidence' data stolen in compromise: PageUp

An independent forensic investigation commissioned by PageUp People has been unable to find evidence that a malware infection led to data being exfiltrated from its systems earlier this year, the company now says. 

In its latest update on the security incident, the Australian recruitment cloud service provider said forensic experts had found “no specific evidence” that data was taken.

“A detailed forensic investigation on the PageUp security incident in May this year has concluded that while an attacker was successful in installing tools that could exfiltrate data, no specific evidence was found that data was exfilitatrated,” the company said on Wednesday.

It said expert forensic analysts Klein & Co had “collected and analysed all available digital forensic evidence related to the incident” that saw an unauthorised party gain access to parts of PageUp’s internal systems.

The conclusion is the same as the one made by Australian authorities helping PageUp in the weeks following the incident, who said there was nothing to suggest that any “information may actually have been stolen”.

Australia’s national cyber security adviser Alastair MacGibbon also went as far as to say that PageUp had been “victimised’ by the UK's data breach requirements, which he said did not allow enough time to conduct a thorough investigation.

PageUp People had previously said that “on the balance of probabilities” some data was accessed by an unknown attacker, but has never definitively stated whether it was breached.

The unknown attacker was said to have gained access to the personal details of job applications such as names, street addresses, email addresses and telephone numbers, as well as the usernames and passwords of PageUp employees.

It caused customers to immediately suspended their use of the service provider, particularly to underpin online recruitment sites, over fears a large amount of data was compromised.

More detailed data and documentation held by the company was found not to have been affected.