Topic

#data breach

2 articles

critical1 source

Real-Time ID Scraping Exposes 153 Million Driver's Licenses via Identity Scanning Provider

A massive dark web operation dubbed Nexus was discovered selling roughly 153 million driver's license scans with near real-time ingestion capabilities. Newly presented driver's licenses appeared on the marketplace within hours or days of individuals presenting physical cards at businesses like rental car counters. Investigation into the inventory growth revealed that over a single 24-hour period, approximately 400,000 newly harvested cards were added to the platform's listings. This continuous expansion strongly indicates that threat actors maintained live or active access to an intermediate scanning service pipeline. Publicly available disclosures link identity verification company IDScan.net to multiple commercial clients, including Planet13 and rental car giant Hertz. The scanning platform under scrutiny routinely captures high-fidelity identity data, notably across both infrared and ultraviolet spectral bands. IDScan.net confirmed to reporting outlets that it had launched an internal investigation into the incident, while rental car representatives initially withheld comment. The capture of full-spectrum scans makes this leak significantly more severe than typical database dumps of text-based personally identifiable information. Following public reporting on the exposure, the Nexus dark website went offline, limiting opportunities for individuals to verify their records independently. The Federal Bureau of Investigation has launched an active investigation into the data pipeline breach and subsequent marketplace sales.

medium2 sources

Manchester Airports Group breach exposes booking and Wi-Fi data for 8.7 million travelers

Manchester Airports Group (MAG), operator of Manchester, London Stansted, and East Midlands airports, announced a cyberattack that exposed personal data belonging to approximately 8.7 million customers. Unauthorized third parties gained access to systems handling auxiliary airport services a few days prior to discovery on Tuesday. The exposed data includes customer email addresses, phone numbers, vehicle registration numbers, and postcodes collected via car park reservations, lounge access, Fast Track bookings, and airport Wi-Fi registration captive portals. MAG stated that in the vast majority of cases, only email addresses were compromised. The operator emphasized that neither MAG nor the compromised systems store customer bank or payment card data, so no financial records were leaked. Aviation security, flight schedules, and day-to-day airport operations remain unaffected by the incident. Following detection, MAG isolated the impacted systems, engaged external incident response specialists, and notified relevant UK regulatory authorities. As an immediate containment and precautionary measure, the company disabled its online Manage My Booking portal. Passengers requiring booking modifications within 72 hours are being routed to phone support while upcoming reservations remain active. MAG has initiated direct email notifications to impacted travelers, advising vigilance against follow-up phishing attempts.

← all articles