Recruitment agencies sit on two things that make them attractive to cybercriminals: large volumes of sensitive personal data, and a high-trust, high-frequency flow of money between clients, candidates, and contractors. A firm with 20 or more staff is typically running dozens of live placements at once, processing timesheets and invoices weekly, and holding CVs, passport copies, right-to-work documents, and bank details for everyone who has ever applied – not just those it has placed.
That combination has made staffing and recruitment one of the sectors regulators and trade bodies are now actively warning about. This article sets out where the real risk sits, what has already happened to firms like yours, and what a practical response looks like.
Why Are Recruitment Agencies a Target for Cybercriminals?
A recruitment agency’s core asset is data about people – far beyond what a typical SME holds. Every application, whether or not it leads to a placement, usually generates a CV, contact details, and often supporting documents: passports, proof of address, references, sometimes DBS check results or right-to-work evidence. Multiply that by years of applications and an agency with 20+ staff can be sitting on tens or hundreds of thousands of individual records.
On top of that, agencies run a constant, predictable payment cycle – placement fees from clients, weekly or monthly payroll for temporary and contract workers, and invoices going in both directions. That predictability is exactly what makes payment-diversion fraud effective: an attacker who can read a few weeks of correspondence knows when an invoice is due, who normally sends it, and what a legitimate request looks like.
What Happened When a Manpower Franchise Was Breached?
In August 2025, an independently operated Manpower franchise in Lansing, Michigan disclosed a ransomware attack, claimed by the RansomHub group, which had taken place between December 2024 and January 2025. It exposed personal data for 144,189 job applicants and clients – full names, addresses, email addresses, phone numbers, employment history, and in some cases government-issued identification numbers. The attacker is understood to have exploited weak or stolen credentials and misconfigured remote-access systems to move through internal networks and reach the databases holding this information.
This was a US incident, not a UK one, and ManpowerGroup stated that no corporate systems were affected. It is included here because the shape of it is the point: a single franchise office, weak or stolen credentials, and a candidate database large enough to affect over 140,000 people. A UK agency of similar size holds the same kind of data in the same kind of systems.
How Exposed Are UK Recruitment Agencies Right Now?
A survey of 584 UK recruitment agencies (APSCo, with Atlas Cloud) found:
- 76% of agencies had stolen passwords already circulating on the dark web – credentials that can be used to access email or agency systems without needing to trick anyone.
- Two in three agencies had no phishing protection in place, despite phishing being the primary route attackers use to get into email accounts in the first place.
- A meaningful proportion were running web servers – often the ones hosting candidate application portals and CV uploads – with known, unpatched vulnerabilities.
Separately, the government’s Cyber Security Breaches Survey found 84% of UK businesses experienced a phishing attempt in the past 12 months, and that DMARC adoption (a technical control that stops attackers spoofing a company’s own domain) rose sharply once organisations understood the gap – suggesting many agencies simply haven’t looked at this yet, not that it’s unfixable.
What Does Payment Fraud Look Like Inside a Recruitment Agency?
The mechanics are the same Business Email Compromise (BEC) pattern seen across professional services: an attacker gains access to an email account – the agency’s own, a client’s, or a contractor’s – and reads real correspondence long enough to understand the relationship, the invoicing cycle, and the tone people normally use. Then, at the right moment, a message arrives asking for bank details to be updated: a contractor asking for their payroll details to be changed, a client’s accounts team asking for the agency’s bank details ahead of an invoice payment, or the agency itself being asked to redirect a placement fee.
Because recruitment involves so many one-off and short-term financial relationships – a new contractor each month, a new client each quarter – the normal defence of “you’d recognise if something changed” is weaker than in a business with the same handful of suppliers for years. Every new bank-detail change request needs to be treated the same way, verified by phone using a number the agency already holds, not one supplied in the message itself.
What Are the GDPR Obligations Specific to Candidate Data?
Recruitment agencies hold personal data on people they never place, which creates obligations that go beyond current employees or clients. Candidate data is still personal data under UK GDPR even for someone who applied once, two years ago, and was never contacted again – and it still needs a lawful basis, a defined retention period, and adequate security.
The ICO can fine organisations up to £17.5 million or 4% of global turnover for the most serious breaches, or up to £8.7 million or 2% of turnover under the standard maximum – the tier most relevant to an SME-sized agency. Beyond the fine itself, a breach involving candidate data creates individual notification obligations and reputational risk that is particularly sharp for an agency: the people affected are often actively job-hunting, and a breach becomes a story their own network hears about.
Practical questions worth an agency asking itself: how long is a CV kept after an unsuccessful application, and is that period actually enforced or just written down somewhere? Who can access the full candidate database versus only their own live requisitions? And is the applicant tracking system (ATS) or CV portal itself patched and monitored, given it’s usually internet-facing by design?
How Can a Recruitment Agency Reduce Its Cyber Security Risk?
As with the conveyancing sector, the process side matters as much as the technology. A firm should be able to answer:
- Is there a defined, no-exceptions process for verifying any change to bank details – for contractors, clients, or suppliers – by phone, using a number already on file?
- Does every account with access to the CRM, ATS, or candidate database have multi-factor authentication enabled, not just email?
- How long is candidate data retained after an unsuccessful application, and is that limit actually enforced?
- When was the security of the ATS/CV portal provider last reviewed – is it patched, and who is responsible for that?
- If an email account were compromised today, how long would it take the firm to notice?
Cyber Essentials – the NCSC-backed baseline covering firewalls, secure configuration, access control, malware protection, and patching – is increasingly expected by clients in regulated sectors before they’ll place business with an agency, and is a reasonable first target for a firm that hasn’t yet formalised its security posture.
Want to Talk Through Your Agency’s Exposure?
We work with businesses on the security risks that are most relevant to how they actually operate. Recruitment creates a specific set of conditions: high volumes of candidate data, a constant cycle of new financial relationships, and systems that are internet-facing by design. We’re happy to talk through where the real pressure points sit for your agency specifically, with no packaged pitch attached – book a short conversation if that would help.
FAQs
Is recruitment data breach risk really different from other professional services?
The core risks (BEC, phishing, ransomware) are the same ones every professional services firm faces. What’s different is scale and retention: an agency holds data on far more individuals than it employs or places, often for years, and much of that data sits behind an internet-facing application portal by design – which is a wider attack surface than most SME websites have.
What data should a recruitment agency treat as highest risk?
Passport copies, proof of address, right-to-work documents, and bank details submitted for payroll purposes carry the highest individual risk if exposed, since they enable identity fraud directly. CVs alone are lower-risk individually but carry high aggregate risk simply because of the volume most agencies hold.
Does Cyber Essentials cover an agency’s ATS or CV portal specifically?
Cyber Essentials covers the five foundational controls (firewalls, secure configuration, access control, malware protection, patching) across the systems in scope for certification, which should include any internet-facing candidate portal. It’s worth confirming with whoever manages the certification that the ATS/portal is explicitly included in scope, not just internal email and office systems.
How quickly do candidate data breaches need to be reported?
Under UK GDPR, a qualifying breach must be reported to the ICO within 72 hours of the organisation becoming aware of it, including at weekends. Where the breach is serious, individuals affected may also need to be notified directly.
Sources
- APSCo / Atlas Cloud, ‘State of Cyber Security in Recruitment’ (584 UK recruitment agencies surveyed, 2022–2023) – atlascloud.co.uk
- Rescana, ‘Manpower Franchise & Headhunting Firm Ransomware Breach’ (Aug 2025 incident analysis) – rescana.com
- UK Government, Cyber Security Breaches Survey 2024 (phishing prevalence, control adoption)
- ICO, ‘The maximum amount of a fine under UK GDPR and DPA 2018’ – ico.org.uk
- The REC, ‘Strengthening cyber security in recruitment agencies: act or get hacked’ – rec.uk.com
Working in recruitment? See how we help UK recruitment agencies close these gaps and evidence it to clients on our cyber security for recruitment agencies page.
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
