Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1B identity records exposed in ID verification data leak

aol.com

Post reply on HN
Print view View original

21–30 of 67 posts

Re: 1B identity records exposed in ID verification data leak

#21

Post by bilekas »

pjc50 wrote: post #11
mbix77 wrote: post #4

What did measures like gdpr ever achieve except for making me click a cookie prompt away.

GDPR doesn't apply in the states, but hopefully it provides for some punishment for the poor security here for EU customers. Of course, then some Americans will get mad that a US company has to follow EU law.

> Of course, then some Americans will get mad that a US company has to follow EU law.

This is always the way of the world though, if you want to do business anywhere, you are of course obligated to follow the local laws and regulations. I don't see anyone disputing this outside of blatant patent infringement by certain countries.

Re: 1B identity records exposed in ID verification data leak

#22

Post by tootie »

cataflam wrote: post #6

Almost a month old, original source: https://cybernews.com/security/global-data-leak-exposes-bill... and I've never seen any confirmation elsewhere Looks like CyberNews have edited the article with more info since first I saw it, it used to look quite suspicious and untrustworthy, it now has more info. Still doesn't say exactly what a record is, or how many uniques there are.

It's a weird article. For one, the researcher says "they believe" the data belongs to IDMerit but apparently aren't sure. IDMerit denies it's the owner of the data nor is it any of their partners. And there's very few details about where or how they found this database. It's possibly some kind of hoax or ransom attempt? Or there's really just billions of unaccounted databases of private data just sitting all over the Internet.

Re: 1B identity records exposed in ID verification data leak

#24

Post by uean »

tootie wrote: post #22
cataflam wrote: post #6

Almost a month old, original source: https://cybernews.com/security/global-data-leak-exposes-bill... and I've never seen any confirmation elsewhere Looks like CyberNews have edited the article with more info since first I saw it, it used to look quite suspicious and untrustworthy, it now has more info. Still doesn't say exactly what a record is, or how many uniques there are.

It's a weird article. For one, the researcher says "they believe" the data belongs to IDMerit but apparently aren't sure. IDMerit denies it's the owner of the data nor is it any of their partners. And there's very few details about where or how they found this database. It's possibly some kind of hoax or ransom attempt? Or there's really just billions of unaccounted databases of private data just sitting all over the…

The cybernews article does have some screenshots showing names like “idmb2c” … also that IDMerit was contacted in November and the ports were closed a day later.

Re: 1B identity records exposed in ID verification data leak

#25

Post by frereubu »

cataflam wrote: post #6

Almost a month old, original source: https://cybernews.com/security/global-data-leak-exposes-bill... and I've never seen any confirmation elsewhere Looks like CyberNews have edited the article with more info since first I saw it, it used to look quite suspicious and untrustworthy, it now has more info. Still doesn't say exactly what a record is, or how many uniques there are.

I presume the database exists, but some of the details don't add up. IDMerit say "IDMERIT’s systems and security infrastructure have never been compromised", "there has never been a data breach or exfiltration from [our partners'] systems during, before, or after this event" and "IDMerit does not own, control or store customer data". But Cybernews says that they "promptly secured the database" after being notified. Cybernews also didn't give the reason why they thought this was to do with IDMerit (unless I missed it). I can't quite make head nor tail of it.

Re: 1B identity records exposed in ID verification data leak

#26

Post by ezst »

neya wrote: post #14

If I was in Vegas, I would bet my life savings that the CXOs of the said ID Verification company's data isn't included in the leak. This is just like that Mc Donald's CEO's video - they never use what they create.

Or the tech executives barring their children from using social media.

Re: 1B identity records exposed in ID verification data leak

#28

Post by mapontosevenths »

esperent wrote: post #19

This is actually a Fox News article and as far as I can see it's not corroborated anywhere. I saw a reddit thread about it earlier where someone said the apparent hacker refused to actually show any of the data and was asking for money. So probably just a scam rather than a real leak.

The Fox article just cites CyberNews.[0]

Cybernews posts screenshots[1] featuring usernames like idmKYCCN and idmKYCFR, and the ports were locked down after contacting ID Merit.

I think thay what's happened is that everyone is telling the literal truth and speaking very carefully to use that truth to obscure rather than inform. To hell with the victims. The way I intrerpet this is that their denials are both factually accurate AND misleading.

The partner who said there is "no indication that any customer data has been compromised" is telling the literal truth. They can't find any indicators because they stink at logging and the screenshots posted on CyberNews obscure the customer info intentionally. Instead Cyber News only shows the IDM usernames in plaintext. Which was the responsible thing to do They literally cant see any indications... of customer data... because they dont have logs.

It should also be noted that the Partners customer in this case is likely ID Merit... not the people whose information was stolen. So again, their statement was literally true even if they do find evidence of a billion records being leaked.

Nobody should ever trust anyone involved in this again if I'm correct in this interpretation of the available facts.

[0] https://www.foxnews.com/tech/1-billion-identity-records-expo...

[1] https://cybernews.com/security/global-data-leak-exposes-bill...

Re: 1B identity records exposed in ID verification data leak

#30

Post by outime »

pirate787 wrote: post #27

While this leak may or may not have happened, for this type of exposure there should be criminal liability for developers and executives. Criminal negligence and prison time.

If developers are going to face criminal liability, they should IMHO also have legal ways to push back against certain implementations without risking their jobs, or at least have a way to leave a legal justification somewhere: "I'm doing this because I'm forced to but I disagree" which is then signed by management.

Until then, you're putting the weight of the law on the wrong side of the equation, since developers aren't the ones consciously making risky decisions.

Post reply on HN