YOU CAN CHANGE A PASSWORD — YOU CANNOT CHANGE YOUR FACE, AND 153 MILLION IDS JUST LEAKED FROM THE KYC MACHINE
A password has a reset button. Your face does not.
A password breach is a bad night. You reset the password and move on. This is not that.
A dark-web market called Nexus is claiming about 170 million identity records — more than 153 million U.S. and Canadian driver’s licenses, plus travel and medical documents — skimmed over a year from an identity-verification company. The trail, per Brian Krebs, points to IDScan.net, which runs 21 million ID checks a month across 20,000 locations. The FBI is investigating. The company says it “may be implicated” and is still looking.
Here is the part that should stop you. Dr. Marilyne Ordekian says the dump reportedly includes the infrared and ultraviolet scans — the hidden features used to prove an ID is real. Not just your license, but the blueprint for forging a genuine one. And you cannot reset your face, your birth date, or your home address. “Private keys aren’t the only crypto risk,” she said. “KYC leaks matter too.”
Every gate that asked for your ID — the exchange, the bank, the wire desk — is now a door with your key already copied. And the crypto danger is not abstract: breach victims have been picked out as holders and visited in person for their coins. The honeypot does not only get you phished. It gets you found.
Even the institutions admit the game. The Bank of Japan keeps a standing notice warning that it will never ask for your details and that the investment sites and CBDC pages in its name are fake. When the central bank has to tell you it is being impersonated, the trust model itself is the problem.
The lesson is old, and it is Maximalist. You cannot secure what you have already handed over. The only identity nobody can leak is the one you never surrendered. Not your keys is half of it. Not your data is the other half.
A dark-web market called Nexus is claiming about 170 million identity records — more than 153 million U.S. and Canadian driver’s licenses, plus travel and medical documents — skimmed over a year from an identity-verification company. The trail, per Brian Krebs, points to IDScan.net, which runs 21 million ID checks a month across 20,000 locations. The FBI is investigating. The company says it “may be implicated” and is still looking.
Here is the part that should stop you. Dr. Marilyne Ordekian says the dump reportedly includes the infrared and ultraviolet scans — the hidden features used to prove an ID is real. Not just your license, but the blueprint for forging a genuine one. And you cannot reset your face, your birth date, or your home address. “Private keys aren’t the only crypto risk,” she said. “KYC leaks matter too.”
Every gate that asked for your ID — the exchange, the bank, the wire desk — is now a door with your key already copied. And the crypto danger is not abstract: breach victims have been picked out as holders and visited in person for their coins. The honeypot does not only get you phished. It gets you found.
Even the institutions admit the game. The Bank of Japan keeps a standing notice warning that it will never ask for your details and that the investment sites and CBDC pages in its name are fake. When the central bank has to tell you it is being impersonated, the trust model itself is the problem.
The lesson is old, and it is Maximalist. You cannot secure what you have already handed over. The only identity nobody can leak is the one you never surrendered. Not your keys is half of it. Not your data is the other half.
KEY RECEIPTS
Nexus dark-web listing: ~170M identity records claimed — 153M+ U.S./Canada driver’s licenses, ~10M other IDs, ~3M travel documents, 579,000+ medical cards; allegedly siphoned over a year from an identity-verification firm. (Bitcoin.com News interview, Jamie Redman, Sep 8.)
Trail points to IDScan.net (New Orleans; ~21M ID checks/month, 20,000+ locations); the company says it “may be implicated” and is investigating; FBI probe open. (Krebs on Security.)
Dr. Marilyne Ordekian (incoming Asst. Prof., Durham Law): the dump reportedly includes infrared/UV authentication scans — “not just your ID, but the blueprint and the technical layer used to prove your ID is genuine”; IDs can’t be reset; every ID-gated system is now an attack surface; breach victims physically targeted for their crypto.
Artem Popov (Sumsub, fraud prevention): a document photo alone should never onboard anyone; it needs a second factor such as liveness; biometrics carry their own permanent risk. (Sumsub sells KYC tooling — noted.)
Bank of Japan standing notice: warns it will never request personal or financial information or solicit investments in its name, and flags fake websites impersonating it, including yen-CBDC investment-scam sites. (boj.or.jp, official.)
On the board: our Sep 2 read on IDScan (the machine, not the leak) and tonight’s Liquid phishing PSA.
Not claimed: that IDScan has confirmed a breach, or the full scope. The FBI probe is open and a full forensic account is pending.
Trail points to IDScan.net (New Orleans; ~21M ID checks/month, 20,000+ locations); the company says it “may be implicated” and is investigating; FBI probe open. (Krebs on Security.)
Dr. Marilyne Ordekian (incoming Asst. Prof., Durham Law): the dump reportedly includes infrared/UV authentication scans — “not just your ID, but the blueprint and the technical layer used to prove your ID is genuine”; IDs can’t be reset; every ID-gated system is now an attack surface; breach victims physically targeted for their crypto.
Artem Popov (Sumsub, fraud prevention): a document photo alone should never onboard anyone; it needs a second factor such as liveness; biometrics carry their own permanent risk. (Sumsub sells KYC tooling — noted.)
Bank of Japan standing notice: warns it will never request personal or financial information or solicit investments in its name, and flags fake websites impersonating it, including yen-CBDC investment-scam sites. (boj.or.jp, official.)
On the board: our Sep 2 read on IDScan (the machine, not the leak) and tonight’s Liquid phishing PSA.
Not claimed: that IDScan has confirmed a breach, or the full scope. The FBI probe is open and a full forensic account is pending.
A PASSWORD RESETS. YOUR IDENTITY DOES NOT.
Bitcoin.com News (Jamie Redman) + Krebs on Security + Bank of Japan (official) · Tue Sep 8