Protemps Data Breach (2021): What Was Exposed & What To Do

In October 2021, a data breach at Protemps, a Singaporean recruitment website, exposed information belonging to approximately 50,000 individuals. The incident came to light on 4 October 2021 and involved email addresses along with other categories of jobseeker records. The breach is one of many reported that year against organisations holding employment-related data. Such incidents illustrate how personal information collected for hiring processes can become exposed when security controls fail.

What happened

Public reports state that Protemps suffered a data breach in October 2021 that affected almost 50,000 unique email addresses. The exposed records included names, email and physical addresses, phone numbers, passport numbers and passwords stored as unsalted MD5 hashes, together with additional jobseeker details such as genders, marital statuses, nationalities and job applications. No further information on the method of intrusion, exact timing of access, or total volume of files has been disclosed.

How a breach like this happens

Incidents involving recruitment platforms often begin with unauthorised access to web-facing systems or databases that store applicant information. Attackers may exploit unpatched software, weak authentication, or stolen credentials to reach stored records. Once inside, they can copy files containing personal identifiers and credentials. In many cases the initial entry point remains undetermined in public reporting, and the time between intrusion and discovery varies widely.

About Protemps

Protemps operates as a recruitment service in Singapore, connecting employers with jobseekers and maintaining records necessary for application processing. Organisations in this sector routinely collect names, contact details, identity documents and employment histories to facilitate hiring. A breach at such a firm is consequential because the data it holds can support identity verification and employment decisions, making the records attractive for misuse if they leave the organisation’s control.

What data was at risk

Reports list the following data types as exposed: email addresses, genders, job applications, marital statuses, names, nationalities, passport numbers and passwords. The same reports also note the presence of physical addresses, phone numbers and passwords stored as unsalted MD5 hashes. The precise contents of every affected record remain unconfirmed beyond these categories.

What's at stake

Individuals whose information appeared in the dataset face the possibility that their contact details and identity documents could be used for targeted phishing or account takeover attempts. Passwords stored without modern hashing increase the chance that any reused credentials could be tested against other services. For the organisation, the incident adds to the record of recruitment platforms that have lost applicant data, potentially affecting future trust from both jobseekers and client employers.

Were you affected?

Anyone who submitted an application through Protemps around the period of the breach can review the company’s subsequent notices for confirmation. A practical first step is to change passwords on any accounts that reuse the exposed credentials and to enable multi-factor authentication where available. Readers may also run a free exposure scan of their email address against known breach data sets to check for appearances in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.