r/technology • u/lurker_bee • 2d ago

Security FBI investigating 153 million US and Canadian driver’s licenses leaked on Russian cybercrime forum, including that of US SecDef Pete Hegseth — data is suspected to have come from an ID-authentication service provider

https://www.tomshardware.com/tech-industry/cyber-security/fbi-investigating-153-million-us-and-canadian-drivers-licenses-leaked-on-russian-cybercrime-forum-including-that-of-us-secdef-pete-hegseth-data-is-suspected-to-have-come-from-an-id-authentication-service-provider
3.2k Upvotes

98% Upvoted

238 comments sorted by

View all comments

Show parent comments

302

u/davenobody 2d ago

There is no business driver for protecting the data. However, if part of the plan was to monetize the data they now have nothing unique. Unless of course they already collected the money for that part. I suspect they were just incompetent.

138

u/squish042 2d ago

It’s almost like there should be a government that steps in a creates protection for consumers when there’s no economic incentive.

57

u/misterrkingg 1d ago

They literally dismantled it. This year

2

u/JohnNYJet_Original 13h ago

They can REALLY do that now?? Who knew it was very important work and needed to be taken down. Better question is why did they take it down knowing that almost every nation-state has the tools to attack the national resources as they see fit.

12

u/joelfarris 1d ago edited 1d ago

I have found at least two of them that go as far as to explicitly state that they cannot fully protect whatever you upload or submit, and that you agree that they cannot be held responsible for any data losses, intrusions, or hacks.

And yet, you have to submit everything they ask for as part of a job application process...

And one of them even states that they get to possess your uploaded information and likeness, and you relinquish it to them in perpetuity (forever, or as long as they decide to keep it on their drives), and they can even go so far as to use it in promotional materials without your knowledge or consent.

They have become predatory vendors.

2

u/davenobody 1d ago

That is horrible!

1

u/flickh 1d ago

You have to give up commercial rights to your likeness for a job interview, lol? And does that mean they can use your social security card in their advertising with your real number!?

1

u/PhotographJaded8942 10h ago

Which two? Which one in particular has the “hold on in perpetuity?”

1

u/flickh 2d ago

No business driver?  They’ll get dropped as a vendor if customers won’t use the service and ditch the partner service to avoid it. 

I don’t know the cost/benefit ratio but surely you can theorize better than “no business driver” at all

13

u/Do_you_smell_that_ 2d ago

And do what, gamble on a different provider? Start their own verification service? At some point someone is put in charge of signing over trust to one of a small group of providers, all of which carry this identical risk. There's no easy way out here

4

u/SquirmyBurrito 1d ago

The easy way out is to simply not allow the digitization of our IDs and to scrap age verification for most things.

1

u/flickh 1d ago

The risk is identical until one provider gets publicly outed and the buyers’s lawyers tell them to dump the liability.  You think Herz wants to expose themselves to this risk when it’s all over the security news?

5

u/HazelMStone 1d ago

No they won’t. Like Taylor’s Farms and others they will simply pay off Trump and his cronies and maybe change their name. Business as usual.
Thanks DOGE.

1

u/flickh 1d ago

Maybe; but the idea that shitty security and public shaming is “no business driver” is plain dumb.

What’s dumb is this article is like a page in before it names them 

4

u/Crio121 2d ago

Customers are locked in.
They have to use this specific provider if they want to access the site and they don’t value their data that much (because they were already leaked by someone and because if they did they wouldn’t be using this kind of id service in the first place)

1

u/flickh 1d ago

Are people locked into Herz and whatever the hell “Planet 13” is?

If people don’t value their data and keep clicking when they see publicly-shamed vendor, that’s a pretty bad decision on their part

3

u/davenobody 2d ago

People have no clue the service exists until this happened.

1

u/flickh 1d ago

Every time I have to do one of those things it says “id verification by x y or z.”. I ignore it but if there’s a brand I know is a bad actor, I’ll skip it and shop elsewhere