Catho Data Breach (2020): What Was Exposed & What To Do

In March 2020, the Brazilian recruitment website Catho was compromised. Records from the incident later appeared for sale on a dark web marketplace alongside data from twenty other sites. The breach exposed nearly 11 million records containing 1.2 million unique email addresses along with names, usernames and passwords stored in plain text. The dataset was later supplied to Have I Been Pwned by breachbase.pw. The incident is notable because it affected a large number of individuals who had used the platform for job-seeking activities and because the passwords were not hashed.

Inside the incident

Public reporting places the compromise around March 2020. The data subsequently surfaced on an underground marketplace where multiple breached collections were offered together. No official statement from Catho detailing the method of access, the precise date of intrusion or the total number of accounts originally held by the service has been referenced in available records. The figure of 1.2 million unique email addresses is the only confirmed count of distinct individuals.

How a breach like this happens

Incidents involving online service providers often begin with the exploitation of web application vulnerabilities, weak authentication controls or the reuse of credentials obtained from earlier breaches. Once initial access is gained, attackers may extract database tables containing user records. When passwords are stored without hashing or salting, the entire set of credentials becomes immediately usable. The subsequent listing of such data on dark web forums is a common distribution method, allowing the material to be sold or traded in bulk.

Catho and its sector

Catho operates as an online recruitment platform in Brazil, connecting job seekers with employers. Services of this type routinely collect contact details, account credentials and professional information from users who register to upload résumés or apply for positions. A breach at such a site can expose data belonging to a broad cross-section of the workforce, including individuals who may not have interacted with the platform for some time.

The information in question

The records supplied to Have I Been Pwned contain the following categories:

• Email addresses
• Names
• Usernames
• Passwords stored in plain text

Whether additional fields such as résumé contents, telephone numbers or employment history were also taken remains unconfirmed in public reporting.

The real-world impact

Individuals whose email addresses and plain-text passwords were exposed face an elevated risk that the same credentials could be tested against other online accounts. Because many people reuse passwords across services, the data can facilitate unauthorised access to email, banking or social media profiles. For the organisation, the incident may result in regulatory scrutiny, loss of user trust and costs associated with remediation and notification. No confirmed instances of subsequent fraud tied specifically to this dataset have been documented in the available facts.

Were you affected?

Users can check whether their email address appears in this or other known breaches by submitting it to a public breach-checking service. If exposure is confirmed, the immediate steps are to change the Catho password and any other account that used the same credential, enable multi-factor authentication where available, and monitor for unusual login attempts. Organisations that discover their data in such incidents are expected to notify affected users and advise password resets.

AICompiled with AI assistance from public sources and published under our editorial standards.