Anatomy of Mercor’s Data Breach

Mercor - the recruitment company that isn’t - suffered a massive data breach last month, in which thousands of hours of training data was hacked and made available for purchase on the dark web. The company seems to have suffered surprisingly little fall out from it, I wonder whether it is because we don’t quite know how to value what was stolen. Anyways, fascinating forensic breakdown on how it happened - great read for any of us recruiters leaning into the InfoSec side of the job. Entirely coincidentally (I’m sure), Anthropic go on to release Mythos, an AI which appears to able to spot security issues in software, which have defeated debugging software and humans for decades.

The 2026 State of AI Traffic & Cyberthreat Benchmark Report

Well adjacent to compliance, is information security. Something which I suspect a lot of us recruiting are going to have to get well acquainted with. This is not going to be to everyone’s flavour so I expect a specialism to emerge with Talent Ops which deals specifically on this area. AI training crawlers - software which ingest the internet to feed training models - overtook human traffic last year. Feels like a milestone.

LinkedIn is Searching Your Computer

LinkedIn doesn’t like unauthorised Chrome extensions and has been adding to its prohibition list every year - I think it is up to around 5000 by now? The overwhelming majority of these seem to related to LinkedIn’s core business which for me, is ‘fair enough’, but some others - religious / political extensions - also appear on the list and you wonder how safe such tracking might be, if we are able to ID religious and political affiliations thereby. An InfoSec issue or a DEIB one? Increasingly indistinguishable in these troubled times. H/T to brainfooder Jan Tegze for the share.

AI + HR + United Kingdom

Leave it to an American to come up with the most useful how-to guide for UK employers who care about Data Use and Access Act! Commencement is in June 2026, so you have 3 months to get your house in order. Cheers to brainfooder Andrew Gadomski for putting this together - its great!

I Verified My LinkedIn Identity: Here’s What I Actually Handed Over

I’m generally pro verified ID - can’t see social platforms surviving Agentic AI without it - but it pays to read the terms of service when you do so. OP does the breakdown for us here on LinkedIn’s verification process - turns out its, a third party company which does the ID checking, and which then goes on to holds onto your data…useful how-to at the end if you want to protect where your ID data goes and who holds it. H/T to brainfooders Dorothy Dalton and Andrew Stetsenko for the shares.

Bay Area Woman Loses $176K after Accepting Remote Job She Thought Was With Facebook

We talk a lot about candidate fraud and often forget the fraud risk on the other side. Incredible story of a one job candidate who lost a significant amount of money, after accepting what appeared to be a legit remote job with Facebook.

Recruitment Leaders: You Just Got Promoted To ‘Systems Operator’

How much of infosec currently part of your job? Negligible only a few years ago, the requirement for TA / HR leaders to get on top of the compliance and security risks associated with AI is going up - maybe to the very top - of the priority list. Brainfooder Martyn Redstone digests the ESTI European Standard on AI security and asks the following questions. Martyn is joining Brainfood Live on Responsible AI this Weds, so register here and learn more. H/T to brainfooder Ivan Harrison for the heads up.