A massive data exposure involving the hiring platform Foh&Boh has left millions of job seekers at risk, and its consequences remain relevant in 2026. Researchers at Cybernews discovered that 5.4 million files stored in an Amazon Web Services (AWS) bucket were publicly accessible from at least September 2024 until January 2025. The files were largely resumes and CVs submitted through Foh&Boh, an onboarding and hiring service used by major US retail, restaurant, and hospitality brands. The incident highlights how routine job applications can become a gateway for identity theft and targeted phishing.

foh-boh-resume-leak-exposes-millions-what-job-seekers-must-know-in-2026-image-0

Foh&Boh works with widely recognizable companies. According to Cybernews, the exposed data affected applicants who had applied to or onboarded with brands such as:

  • Taco Bell

  • KFC

  • Hyatt Grand

  • Omni Hotels and Resorts

  • Nordstrom

The exposure was not limited to a single industry. It touched retail, fast food, and hospitality, meaning a broad cross-section of job seekers may have had their personal information exposed. For anyone who submitted an application through Foh&Boh, the leak may have included phone numbers, email addresses, dates of birth, and employment history. Those details are exactly the kind of information that cybercriminals use to build convincing fraud campaigns.

foh-boh-resume-leak-exposes-millions-what-job-seekers-must-know-in-2026-image-1

The Cybernews research team warned that the leak significantly heightens the risk of identity theft. It enables cybercriminals to create synthetic identities or fraudulent accounts, leaving individuals exposed to a range of sophisticated cyberattacks. A resume may seem harmless, but when combined with a date of birth and employment history, it becomes a valuable tool for opening bank accounts, filing false tax returns, or impersonating a victim.

Exposed data type How criminals may abuse it
Phone numbers SMS phishing, SIM-swap attempts, and voice scams
Email addresses Targeted phishing and credential theft
Dates of birth Synthetic identity creation and account verification
Employment history Convincing pretexts for corporate phishing
Education history Fake alumni requests and donation scams

In 2026, the incident remains a cautionary tale. Data leaks are unfortunate consequences of day-to-day processes existing online. Job seekers often have little choice but to upload identification information, resumes, and onboarding documents to cloud-based systems. However, that convenience does not guarantee security. The Foh&Boh case shows that even established hiring platforms can accidentally expose files through misconfigured cloud storage.

For affected individuals, the first priority is credit monitoring. Personal identification information, like that found on a resume, can be used to apply for fraudulent bank accounts. Identity protection services, such as those offered by NordVPN, can help keep tabs on credit scores and alert users to suspicious activity. Social media accounts also deserve attention, because hackers tend to love personal data-rich profiles. A compromised email or social account can become the starting point for more serious attacks.

Targeted phishing is another major concern. With employment and education history in hand, cybercriminals can make a phishing message far more convincing. An attacker could email a victim pretending to be from their alma mater asking for donations, or from a previous employer requesting financial documents. Such messages may reference real details, which makes them harder to dismiss as spam.

⚠️ Warning signs of targeted phishing include:

  • Messages that mention your real employer, school, or job title

  • Urgent requests for money, documents, or login credentials

  • Senders using lookalike domains or free email services

  • Attachments or links that ask for personal information

  • Pressure to act quickly or bypass normal procedures

To reduce risk, security experts recommend a few practical steps. Keep the personal details on a resume to a minimum when possible, though some employers request specific data. Assume that uploading identification information to any cloud might not be secure. Use multi-factor authentication on email and social accounts. Monitor financial statements and credit reports for unexpected activity. Consider identity theft monitoring tools that can detect early signs of fraud.

The Foh&Boh leak was shut down in January 2025, but the data may still circulate. In 2026, job seekers should treat the incident as a reminder that application materials are sensitive documents. A resume is not just a summary of work history; it is a collection of personal data that can be weaponized. Companies that manage hiring data have a responsibility to secure it, and individuals must remain vigilant when their information is exposed.