Originally reported by Brian Krebs, and then picked up by other outlets like SecurityWeek, the IDScan breach was big news last week. But what really happened? Let’s dive into it.
IDScan.net turned routine compliance checks into a permanent liability for 153 million people. When an illicit search portal called Nexus surfaced on Russian forums with a searchable database of North American driver’s licenses, passports, and medical cards, it exposed the structural failure behind third-party identity verification. Krebs on Security confirmed the validity of the data by finding his own credentials, alongside those of acquaintances and active federal agents, tracing the compromise straight back to IDScan.net’s backend systems.
The intruders claimed over a year of dwell time inside IDScan.net’s central infrastructure. This was an assault on internal object stores, administrative credentials, and backend pipelines. Car rental companies like Hertz, along with dispensaries and retailers, scanned IDs at the counter to verify age or authorization. Instead of confirming a date of birth and discarding the image, the platform warehoused raw front-and-back scans, complete with infrared and ultraviolet captures.
Hoarding that imagery was architectural negligence. An identity check needs to validate a document and emit a Boolean result or an extracted token. Storing high-resolution, multi-spectrum images creates a toxic data hoard with zero operational value to the consumer, who never consented to a relationship with the vendor in the first place. Once compromised, that data cannot be reset like a password.
Static identity documents are dead as an authentication factor. If an organization still accepts an uploaded PDF or JPEG of a driver’s license for KYC (Know Your Customer) verification, account recovery, or wire transfers, it’s authenticating users against dark-web commodities. Engineering teams evaluating verification vendors need to enforce ephemeral processing contracts that purge raw scans immediately after attribute extraction, backed by tight egress thresholds on cloud storage to catch bulk exfiltration before millions of records vanish.
Projects
- SANS SEC504 (aka GCIH)
- TryHackMe
Videos
Articles
- Hasbro Data Breach Exposed Employee Personal Information – A cyberattack caused disruptions at the toy and game giant earlier this year and the company is now disclosing a data breach.
- Five Venezuelans plead guilty to ATM jackpotting attacks in US – Five Venezuelan nationals pleaded guilty to attempting to empty automated teller machines (ATMs) using malware in a series of ATM jackpotting attacks.
- 23-Year-Old Sality P2P Botnet Disrupted – The shutdown operation involved peer list manipulation and Sality payload URL takedown.
- US charges Russian for infecting 80,000 freelancers with malware – A California federal grand jury has indicted a Russian national for his role in a phishing campaign that infected thousands of freelancers with TVRAT and DarkVNC malware.
- 153 Million Driver License Images Offered on Dark Web – Cybercriminals are offering digital scans of US and Canadian driver’s licenses, likely stolen from IDScan.net.