98% of fraudulent hires have company credentials by the time they’re caught
Overview
A recent report from HYPR reveals a significant security concern in the hiring process. It found that 98% of fraudulent hires have obtained legitimate company credentials by the time they are identified as threats. The problem lies in a 90-day gap between hiring and onboarding, which allows attackers to exploit this period by passing remote interviews and receiving authentic access from IT departments. Bojan Simic, CEO of HYPR, emphasized that relying on human intuition isn't enough to secure companies against such risks. This situation highlights the need for better verification technologies to prevent identity fraud in the hiring process.
Key Takeaways
- Affected Systems: Company credentials, identity verification processes
- Action Required: Implement purpose-built verification technologies and improve identity security measures during the hiring process.
- Timeline: Newly disclosed
Original Article Summary
A 90-day period between hiring and onboarding is creating a blind spot in enterprise identity security, according to HYPR’s State of HR Identity Fraud Detection report. “Adversaries no longer need to breach a network when they can pass a remote interview and receive authentic credentials directly from IT,” said Bojan Simic, CEO of HYPR. “Human intuition is not a security control. Sceptics might point to low reported numbers, but the lack of purpose-built verification technology … More → The post 98% of fraudulent hires have company credentials by the time they’re caught appeared first on Help Net Security.
Impact
Company credentials, identity verification processes
Exploitation Status
No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.
Timeline
Newly disclosed
Remediation
Implement purpose-built verification technologies and improve identity security measures during the hiring process.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Exploit.