Threat Intelligence Brief
Curated summary with source attribution
Source: krebsonsecurity.com
Threat Risk: High
Victim: North American citizens and identity verification service users
Incident: A data breach at an identity verification firm resulted in the exposure and sale of 153 million driver’s licenses.
Impact: Extreme risk of large-scale identity theft, account takeovers, and synthetic identity fraud.
Attacker: Nexus (Unidentified threat actors)
Analysis: The Nexus identity theft service claimed to have spent over a year exfiltrating data from a major identity verification provider. The leak includes digital scans of driver’s licenses, passports, and medical cards, providing attackers with a goldmine for identity theft. This incident highlights the critical risk posed by third-party identity verification vendors who store sensitive PII.
Recommendations: Enable multi-factor authentication on all financial and government accounts; Enroll in credit monitoring and freeze credit reports to prevent fraudulent accounts; Audit third-party vendors to ensure sensitive ID data is not stored longer than necessary
Source: Krebs on Security
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source