[Investigating][Severity: Critical][Credential abuse]

iDA: MyBRANDS job site intrusion

A misused cloud access key at a contractor may have exposed up to about 135,000 MyBRANDS accounts, including career profiles and stored login passwords.

Disclosed

2026-10-30

Organizations involved

Leaked or at risk

135K

135,000

Downtime

Unknown

What happened

2026-10-21
Through 22 October, a third party used the management access key of the cloud that a contractor uses and sent data out from a copy of the database. [1]
2026-10-26
The transfer records were found while the service was down for vulnerability work. [1]
2026-10-30
iDA disclosed the incident and began notifying affected people by email. [1]

Impact

Up to about 135,000 accounts of job seekers and company contacts, including people who left, are affected: names, email addresses, phone numbers, profiles with career histories and converted login passwords. Names, email addresses, phone numbers and addresses were encrypted, but the decryption key may also have been taken. iDA could not see what was sent and treats all stored data as affected. It holds no card or bank account data. [1]

Response

MyBRANDS stays offline until it is confirmed safe; iDA's other services are not affected. iDA reported to the Personal Information Protection Commission and consulted the police. It asks users to change passwords reused elsewhere. [1]