Twenty-six million CVs sat exposed online after a recruiting software vendor left a Microsoft Azure storage container open without access controls, according to IT Pro. A misconfigured cloud-storage setup caused the leak — an error cybersecurity specialists describe as increasingly common as HR data migrates to public-cloud platforms.

For HR teams, the incident raises immediate questions about which processor shoulders responsibility when applicant data leaks. The findings put recruitment-software security on the same board-level agenda as payroll and benefits.

What happened?

The recruiting software firm failed to restrict access to its Azure container, leaving personal details readable to anyone who located the storage address. The 26 million CVs rank among the largest candidate-data exposures on public record; for scale, that volume roughly matches the population of Australia, lost in one vendor misstep.

The IT Pro report does not publicly identify the vendor, the discovery date, or how long the container remained open before researchers reached it. HR Briefing will continue tracking the story as IT Pro provides more details.

Why should HR leaders act now?

Applicant tracking systems hold some of the most sensitive data an employer collects: home addresses, full employment histories, current salary expectations, and identity documents used in right-to-work checks. A single CV typically contains 50 to 80 fields, many regulated under GDPR, CCPA, or sector-specific employment rules.

When HR shifts that workflow to a vendor, data-controller obligations rarely move with the contract. The risk extends beyond compliance paperwork; affected candidates may include senior executives, employees at competing firms, and people who never signed a privacy notice with the employer relying on the downstream vendor.

Regulators in the European Union and California have begun pressing employers to map every processor that touches recruitment data. IT Pro cites cybersecurity experts warning that default cloud settings frequently ship open during fast deployments, leaving HR exposed to vendor mistakes they did not commit but must explain.

What practical steps reduce exposure?

Talent-acquisition leaders can convert this incident into measurable due-diligence checks rather than abstract concerns. The audit burden now falls on HR, not IT, when a recruiter-selection decision reappears in a regulatory inquiry.

• Request SOC 2 Type II reports covering the trailing 12 months, and confirm the audit scope extends to cloud-storage configuration.
• Negotiate vendor-offboarding clauses that require certified data destruction within 30 days, with audit rights after termination.
• Map every processor in the hiring funnel — including assessment tools, background-check vendors, and AI résumé-screeners — against one consistent control standard.
• Document the chain of custody for every data transfer between the ATS, HRIS, payroll, and assessment vendors.
• Ask providers for evidence of automated container configuration scanning, not only annual penetration tests.

What's next for HR data governance?

Recruiting-software consolidation continues as larger HR platforms absorb point solutions. A single misconfiguration on a larger platform could soon exceed 26 million files rather than match that threshold.

International hiring pipelines compound the exposure. A recruiting vendor serving Europe, the U.S., and Asia typically triggers breach-notification clocks in multiple jurisdictions within hours of disclosure, not weeks.

HR teams that have not inventoried external data processors should expect regulators and plaintiff attorneys to treat that omission as a measurable gap. HR Briefing will update this story once IT Pro publishes the vendor name, the discovery and remediation dates, and the specific Azure configuration involved.