153 Million Driver's Licenses Hit the Dark Web

IDScan.net, a company that businesses use to verify government-issued IDs at point of sale, confirmed it was hacked after independent journalist Brian Krebs found the stolen data listed for sale on Nexus — a dark web marketplace with ties to Russia — according to The Record.

The database on offer includes scans of roughly 153 million Canadian and US driver's licenses, 10 million ID cards, three million travel documents, and over 579,000 medical cards. IDScan quietly posted a breach notice on September 4 but embedded a directive telling search engines not to index the page — meaning anyone who didn't already know to look for it wouldn't find it.

The company told affected customers the data wasn't being given away freely, which is a bit like a bank robber telling you not to worry because the thieves are asking for money before handing out account numbers.

IDScan has not confirmed how many customers are affected. The FBI has opened an inquiry.

What you should do: If you've ever shown your driver's license at a cannabis retailer, gun store, or bank that uses IDScan's verification system, assume your ID details may be in this database. Place a free credit freeze with all three major bureaus (Equifax, Experian, TransUnion) now. A freeze costs nothing and stops anyone from opening new credit accounts in your name.

A likely Russian-speaking attacker used hundreds of coordinated AI agents to hunt down, compromise, and pivot through vulnerable installations of PaperCut — print management software used widely in corporate and education environments — according to analysis published by threat intelligence firm GreyNoise, covered by Dark Reading.

The AI swarm went from a blank workspace to achieving RCE (remote code execution — when an attacker runs their own commands on a machine they don't own) against a real victim in under four hours. Once the full campaign launched, the swarm compromised at least 11 organisations across 48 countries in 26 seconds. The attacker also used lateral movement (spreading through a network after gaining initial access) to target Windows Active Directory environments.

Google separately warned on September 8 that the most advanced attackers are now embedding AI agents across every stage of their attack chains.

What you should do: If your organisation uses PaperCut, check that it is patched and not exposed directly to the internet.

What GitLab is: GitLab is a web-based platform that teams use to host, review, and collaborate on software code.

What it is: A path traversal flaw (where an attacker manipulates file path references to reach files they shouldn't be able to access) that lets an unauthenticated user read any file on the GitLab server in a single HTTP request.

Who's at risk: Anyone running a self-hosted GitLab CE or EE instance on an affected version. Cloud-hosted GitLab.com users are already patched.

CVSS: 10.0 (Critical — patch today, ahead of anything else on your list).

Root cause: The server fails to sanitise file path inputs before processing them, allowing a specially crafted request to escape the intended directory and reach arbitrary files — including credentials and configuration secrets.

Attack vector: An attacker sends a POST request to /api/v4/projects/{id}/repository/commits/ with a manipulated file.path parameter. No login required. The server returns the requested file's contents directly.

Detection strategies: Search your logs for POST requests to /api/v4/projects/{id}/repository/commits/ URIs that include file.path parameters. Unexpected hits from external IPs are a strong indicator of exploitation.

Recommended actions:

1. Upgrade to GitLab 19.1.8, 19.2.6, or 19.3.2 immediately
2. If you cannot patch right now, restrict external access to the GitLab API at your firewall
3. Review logs for the pattern above and audit recent access to sensitive configuration files

A year-long study by security awareness platform Pistachio sent 2.47 million simulated phishing emails to 123,000 employees across 1,200 organisations, and found that click rate — the metric most phishing training programmes are judged on — tells only part of the story, according to SecurityWeek.

What actually matters is what happens after the click: 30% of tech and IT workers clicked at least once, and nearly 20% of construction employees handed over credentials after clicking. A click with no credential submission creates no real breach.

What you should do: If your organisation runs phishing simulations, push for reporting that tracks credential submission and suspicious-email reporting rates alongside clicks. If you're an individual, the habit worth building is simple: before entering a password anywhere, check the URL bar first.

Starting today, any organisation that sells internet-connected products in the EU must report actively exploited vulnerabilities or serious security incidents to ENISA (the European Union Agency for Cybersecurity) within 24 hours of discovery, per Dark Reading. A fuller notification is due within 72 hours. Missing the window risks fines of up to €15 million or 2.5% of global annual revenue. Physical location doesn't matter — if you sell into EU markets, this applies to you. Small enterprises under 50 employees have limited exemptions; larger organisations do not.