Critical

153 Million Driver License Images Offered on Dark Web

SecurityWeek

September 3, 2026 at 10:54 AM

Actively Exploited

Overview

Cybercriminals are reportedly selling digital scans of approximately 153 million driver’s licenses from the US and Canada on the dark web. These images are believed to have been stolen from a company called IDScan.net, which specializes in identity verification technology. The leaked data includes sensitive information that could be used for identity theft and fraud, putting millions of individuals at risk. The incident raises concerns about the security measures in place at IDScan.net and the potential for further breaches if such data can be easily accessed. This situation serves as a reminder for individuals to monitor their personal information closely and for companies to strengthen their data protection practices.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Driver's licenses from the US and Canada, IDScan.net
Action Required: Companies should enhance their data security measures and individuals need to monitor their personal information for any signs of unauthorized use.
Timeline: Newly disclosed

Original Article Summary

Cybercriminals are offering digital scans of US and Canadian driver’s licenses, likely stolen from IDScan.net. The post 153 Million Driver License Images Offered on Dark Web appeared first on SecurityWeek.

Impact

Driver's licenses from the US and Canada, IDScan.net

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Companies should enhance their data security measures and individuals need to monitor their personal information for any signs of unauthorized use.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Data Breach.

Read Original Article

Related Coverage

D-Link warns of max severity zero-day bug in DIR-822A routers

BleepingComputer

D-Link has issued a warning about a serious vulnerability, identified as CVE-2026-86296, that affects its legacy DIR-822A dual-band Wi-Fi routers. This zero-day bug has been assigned the highest severity rating, and there is currently no patch available to fix the issue. With proof-of-concept exploit code publicly accessible, attackers could potentially exploit this vulnerability to compromise these devices. Users of the DIR-822A routers should take immediate precautions to secure their networks, as the lack of a fix leaves them vulnerable to attacks. D-Link's warning emphasizes the need for users to remain vigilant and consider upgrading to more secure router models.

Sep 22, 2026

New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory

The Hacker News

A newly discovered flaw in the Linux kernel's KVM virtualization code for ARM64 processors poses a significant risk. This vulnerability, identified as CVE-2026-89775, allows guest virtual machines with nested virtualization enabled to gain read-write access to freed host memory. Researchers warn that this could enable attackers to escape the guest environment and execute code directly on the host machine. This issue is particularly concerning for systems that rely heavily on virtualization for security and isolation, as it could compromise the integrity of the host operating environment. Users and organizations utilizing ARM64 virtualization should be aware of this vulnerability and take necessary precautions.

Sep 22, 2026

SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

The Hacker News

A vulnerability in SharePoint Server, originally labeled by Microsoft as a spoofing flaw with a CVSS score of 6.5, has been reclassified to allow for authenticated remote code execution (RCE). This flaw, identified as CVE-2026-65660, impacts SharePoint Server versions 2016, 2019, and Subscription Edition. Researcher Dinh Ho Anh Khoa from Viettel Cyber Security provided detailed technical insights, revealing the severity of the issue. The ability for attackers to execute remote code poses significant risks, especially for organizations relying on these SharePoint versions for collaboration and data management. Microsoft has released patches to address this vulnerability, and users are urged to apply these updates promptly to protect their systems.

Sep 22, 2026

Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal

The Hacker News

Researchers have discovered a malicious npm package called 'indexed-btree' that masquerades as a legitimate tool used for B-tree indexing. Unlike typical malicious packages that employ lifecycle scripts to execute harmful actions, this one hides its malicious behavior within the application code itself. This shift in tactics suggests that attackers are adapting to new security measures that aim to protect users from obvious threats. The package mimics a trusted utility, potentially tricking developers into integrating it into their projects. This incident raises concerns for developers and organizations relying on npm packages, as it illustrates the evolving nature of supply chain attacks in the software development ecosystem.

Sep 22, 2026

SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing

The Hacker News

The cyber group known as SideCopy has shifted its focus to academic institutions in India, previously known for targeting government entities. Researchers from Trellix have reported that SideCopy is employing spear-phishing tactics that utilize mshta.exe to run harmful scripts, effectively bypassing typical security measures. This change in target demographic raises concerns about the security of educational institutions, which may not have the same level of protection as government systems. The use of advanced phishing techniques indicates a growing sophistication in SideCopy's operations, posing a significant risk to sensitive academic data and research. Institutions need to bolster their cybersecurity defenses to protect against such tailored attacks.

Sep 22, 2026

One Hidden Meta Muse Setting Could Let Attackers Turn the AI Assistant Into a Backdoor

The Hacker News

A security vulnerability has been discovered in Meta's Muse assistant that could allow malware already on a Mac to hijack the assistant. Researcher Patrick Wardle demonstrated that by modifying a hidden setting, attackers could redirect voice commands meant for Muse to themselves. This means that any sensitive information users dictate could be intercepted by malicious actors. The issue stems from the broad permissions granted to the Muse app, which can be exploited if the malware is already present on the device. This incident raises concerns about the security of AI assistants and the potential for them to be weaponized against users.

Sep 22, 2026