Data breach exposes over 5 million resumes on popular job platform LiveCareer

A major data breach has exposed over 5 million resumes stored on a cloud server tied to LiveCareer, a global job search and resume-building platform, leaving millions of job seekers vulnerable to identity theft, scams, and fraud. The leak, discovered by cybersecurity researchers at Cybernews, stemmed from a misconfigured Microsoft Azure storage container that remained publicly accessible on the internet.

The unsecured cloud bucket contained more than 5.1 million files, predominantly resumes and CVs, dating from 2016 to 2025. The documents included a wealth of personally identifiable information (PII) such as full names, phone numbers, email addresses, home addresses, and complete employment histories. With this level of detail, experts warn that affected individuals face a heightened risk of targeted phishing schemes, financial fraud, and impersonation.

The breach is linked to LiveCareer, a platform founded in 2004 that provides digital tools for job seekers including resume templates, cover letter generators, and job listings. The service boasts more than 10 million users across 180 countries. Based on the scale of the leak, researchers estimate that nearly half of the platform’s users may have had their data compromised.

Despite multiple attempts by Cybernews to reach LiveCareer, the company has not issued a public statement regarding the breach as of publication.

Security experts emphasize that cloud storage misconfigurations remain a persistent problem in 2025. Improperly secured Azure, AWS, and Google Cloud instances continue to expose sensitive data across industries. In this case, the LiveCareer exposure appears to have gone unnoticed for years, with some of the leaked documents possibly accessible since 2016.

The implications of this breach extend beyond basic privacy concerns. With emails and phone numbers exposed, attackers can launch sophisticated phishing, vishing (voice phishing), and smishing (SMS phishing) attacks. By impersonating employers or recruiters, cybercriminals can lure victims into sharing even more sensitive information, including identification documents and financial details. Fraudulent job offers or requests for “training fees” are common tactics used to exploit such data.