Kenya
Recruitment / Cloud Misconfiguration
$2,000 USD
Kenyan Recruitment Platform Snapstartalent Allegedly Dumped With National IDs, Resumes and Recorded Video Interviews
A forum user posting as exfilar is offering what they describe as a live extraction of the production backend behind Snapstartalent.com, a Kenyan recruitment platform, comprising 176,795 database records and 249GB of downloaded files. The seller states the Firestore project carried no security rules and that every collection was pulled without a token. The claimed contents centre on jobseekers rather than the business: candidate profiles carrying Kenyan national ID numbers, dates of birth and salary expectations, tens of thousands of resumes, and 14,965 video interviews containing face recordings. Records are said to span five years and to include 83 corporate employers using the platform. The asking price is $2,000. The claim is unverified.
▣Post details
Kenya!Allegedly included
- Kenyan national ID numbers
- Full names and dates of birth
- Phone numbers and emails
- Salary expectations
- 93,462 candidate profiles
- 83,237 job applications
- 45,165 resume documents
- 14,965 video interviews
- Face recordings of candidates
- 54,964 profile photographs
- Employer tenant records
- Recruiter chat messages
- Signed file access URLs
- Five years of history
◱Screenshots
⚠Potential impact
The harm here falls almost entirely on jobseekers, who are not the platform's paying customers and have no direct relationship with whoever failed to configure it. The Kenyan national ID number is the identifier used across banking, mobile money and SIM registration, and pairing it with a name, date of birth and phone number supplies most of what identity verification checks look for. Resumes add employment history and referee contacts, while stated salary expectations let an attacker sort targets by income before ever making contact. The video interviews are the hardest element to contain, because a face recording is permanent biometric material that cannot be reissued, and it sits alongside the identity number belonging to the same person. Applications are also said to be organised by employer, which means the set doubles as a ready-made pretexting kit for targeting named companies through people who genuinely applied to them.
iStatus
UnverifiedThe collection breakdown is internally consistent and the document counts reconcile against the stated total, but every figure originates with the seller. The listing describes access as read only, with no indication that records could be modified, which is narrower than some of this actor's recent claims. The post names 83 employer tenants, including international audit networks, a Kenyan commercial bank and several large retailers and manufacturers, though their inclusion reflects use of the platform rather than any compromise of those companies, and none is named here for that reason. Dark Web Informer is not reproducing the sample links, the contact route, or any identifier from the records. The claim is unverified and neither the platform nor the named employers have publicly addressed it.
DARK WEB INFORMER - THREAT INTELLIGENCE
