Latest / Tech Talks With Kinsoft / 153 Million Driver's Licences - The Scanner at the Front Desk, and the Shop That Sold What It Saw

Transcript

153 Million Driver's Licences - The Scanner at the Front Desk, and the Shop That Sold What It Saw · Tech Talks With Kinsoft

• 0:00
  Picture the last time you handed your driver's
• 0:01
  license to a hotel clerk or, you know, maybe
• 0:04
  a rental car agent. Right. They slid it onto
• 0:07
  a little plastic scanner. It flashed a bright
• 0:09
  light and they just handed it right back to you.
• 0:11
  Exactly. And you don't even think about it. No,
• 0:14
  you probably didn't think twice. But what if
• 0:16
  I told you that mundane little flash of light
• 0:19
  just turned your physical identity into an infinitely
• 0:23
  replicable digital ghost? Oh, wow. Yeah, and
• 0:27
  that ghost is currently up for sale on the dark
• 0:30
  web. It really is the ultimate invisible transaction.
• 0:34
  Right. We have this built -in assumption that
• 0:36
  once the card is back in our wallet, you know,
• 0:38
  the interaction is totally over. Right. We just
• 0:41
  assume. whatever data that little machine captured
• 0:44
  just evaporates into some secure momentary void.
• 0:47
  Okay, let's untack this because today's deep
• 0:49
  dive is a forensic look at a massive and quite
• 0:52
  frankly staggering dark web data discovery that
• 0:55
  answers exactly what happens after that scanner
• 0:58
  flashes. Yeah, it's a huge deal. It really is.
• 1:00
  We are going to explore the brilliant investigative
• 1:04
  methodology used to uncover the source of this
• 1:06
  massive data dump. And more importantly, the
• 1:10
  urgent wake up call it provides for absolutely
• 1:13
  any business that scans IDs. And for you, you
• 1:16
  know, the person actually handing it over. Exactly.
• 1:18
  And it is so crucial to state right up front
• 1:21
  that this isn't just another run of the mill
• 1:23
  story about a computer network getting hacked.
• 1:25
  Right. It's bigger than that. Much bigger. Yeah.
• 1:27
  This is a masterclass in understanding the invisible
• 1:30
  pipeline of our most sensitive personal data.
• 1:33
  It exposes the structural mechanics of how identity
• 1:36
  works and how it spectacularly fails in the modern
• 1:40
  digital economy. To really understand why handing
• 1:43
  over an ID at a front desk is suddenly so incredibly
• 1:46
  risky, we have to look at where those scanned
• 1:48
  images ultimately surfaced. We are pulling from
• 1:51
  an independent investigation into a massive data
• 1:53
  breach that broke on September 1st. And the sheer
• 1:56
  scale of the numbers here is, well, it's difficult
• 1:59
  to wrap your head around. It really is. A Russian
• 2:01
  language cybercrime forum was hosting this searchable
• 2:05
  subscription style dark web service. It was called
• 2:08
  Nexus. The business model there is actually really
• 2:11
  important to understand. It's a subscription
• 2:13
  service. Right. So it operates almost like a
• 2:15
  legitimate data brokerage or like a streaming
• 2:18
  platform, but entirely for stolen identities.
• 2:22
  Wow. Yeah. Criminals aren't buying one ID at
• 2:25
  a time. They're paying a monthly fee to access
• 2:28
  this fire hose of raw, searchable human identity.
• 2:33
  And the inventory of this Nexus service was breathtaking.
• 2:36
  We are talking about over 153 million U .S. and
• 2:40
  Canadian driver's licenses. Just staggering.
• 2:42
  Plus 10 million state ID cards, 3 million travel
• 2:46
  documents, and over 579 ,000 medical and cannabis
• 2:51
  dispensary cards. When you hear a number like
• 2:53
  153 million, you really have to contextualize
• 2:56
  the scale. Yeah, it's massive. That is a massive
• 2:58
  percentage of the entire adult population of
• 3:00
  North America. We are not talking about a target.
• 3:02
  Right. This is an industrial scale of data collection.
• 3:06
  But the scale isn't even the most terrifying
• 3:08
  part, honestly. It's the depth of the data. Yes.
• 3:11
  Nexus wasn't just selling text data. They weren't
• 3:14
  just giving subscribers spreadsheets with names,
• 3:17
  birthdates and, you know, address fields. Right.
• 3:19
  Which would be bad enough. Exactly. But they
• 3:21
  were selling the actual high resolution images.
• 3:24
  Right. And it wasn't just one flat picture per
• 3:27
  person. Every single record contained exactly
• 3:30
  six image files. Six. Six. They had the front
• 3:33
  and the back of the document scanned in normal
• 3:35
  light. Plus the front and back scanned in infrared
• 3:38
  light. And the front and back scanned in ultraviolet
• 3:41
  light. All of this was tied together with a highly
• 3:44
  specific date and time stamp in the file name.
• 3:46
  Which is an incredibly specific, very deliberate.
• 3:50
  Data architecture. And I have to push back on
• 3:52
  this because it feels like massive overkill.
• 3:54
  How so? Well, why would a criminal syndicate
• 3:56
  care about infrared and ultraviolet images? Doesn't
• 4:00
  storing six high resolution images per person
• 4:03
  just make the database pointlessly massive and,
• 4:06
  I mean, expensive to host? It does take a lot
• 4:08
  of space. Yeah. Right. If a fraudster just wants
• 4:11
  to steal my identity to open a fraudulent credit
• 4:14
  card or a bank account. Don't they just need
• 4:16
  the text details and maybe a standard picture
• 4:18
  of the front of the ID? What's fascinating here
• 4:21
  is the underlying intent behind why those specific
• 4:24
  light spectrums are captured and how modern fraud
• 4:27
  actually works today. Okay. It's all about bypassing
• 4:30
  automated security. Oh, I see. Yeah. So when
• 4:33
  an automated banking app or a cryptocurrency
• 4:35
  exchange asks you to verify your identity by
• 4:38
  holding your license up to your smartphone camera,
• 4:41
  the artificial intelligence isn't just looking
• 4:44
  at your photo. What is it looking for? It is
• 4:46
  looking for the hidden physical security features
• 4:48
  embedded in the card itself. You mean things
• 4:51
  like the holograms or the micro printing? Exactly.
• 4:53
  The specialized inks and watermarks that only
• 4:56
  react to certain light frequencies. Those specific
• 4:58
  light spectrums, the UV and the infrared, are
• 5:01
  the precise... details required to prove to a
• 5:03
  computer that a document isn't a digital forgery.
• 5:06
  Wait, so how does a 2D image of a UV scan trick
• 5:09
  a modern 3D facial recognition or like a banking
• 5:12
  camera? Through synthetic video, often called
• 5:15
  deepfakes. Oh, of course. Yeah. If a criminal
• 5:18
  wants to create a digital spoof of your identity,
• 5:21
  they take those raw UV and infrared files and
• 5:24
  feed them into software that creates a virtual
• 5:26
  camera feed. Wow. When the banking app requests
• 5:30
  camera access, it gets routed to this virtual
• 5:33
  feed instead of a real webcam. That is wild.
• 5:36
  The software then perfectly simulates how light
• 5:39
  would bounce off those hidden holograms as the
• 5:42
  quote unquote card is moved around on screen.
• 5:44
  No way. Yeah, completely tricking the AI into
• 5:47
  thinking a legitimate, physical, government issued
• 5:49
  piece of plastic is sitting right there in front
• 5:52
  of the lens. That's terrifying. By having these
• 5:54
  six specific images, it elevates the crime from
• 5:58
  simple credit card fraud to highly sophisticated,
• 6:01
  undetectable. biometric impersonation. That is
• 6:04
  deeply unsettling. So that leaves us with over
• 6:07
  150 million of these incredibly detailed, highly
• 6:11
  weaponized files sitting on the dark web. The
• 6:13
  immediate question becomes, how do you even begin
• 6:15
  to prove where they came from? I mean, they're
• 6:17
  just anonymous files. Which brings us to the
• 6:20
  methodology of independent security journalist
• 6:22
  Brian Krebs, who investigated this dump. And
• 6:25
  the sleuthing here is genuinely brilliant. It
• 6:28
  really is. Because it is extremely difficult
• 6:31
  to look at a pile of 150 million driver's licenses
• 6:35
  and pinpoint the exact source of the leak. By
• 6:38
  definition, your ID card is used in dozens of
• 6:41
  different places over its lifespan. So to find
• 6:44
  the source, Krebs didn't just guess. He essentially
• 6:46
  engineered a control group. Right. He actually
• 6:49
  found his own driver's license in this Nexus
• 6:51
  dataset first. Then he went out and acquired
• 6:55
  explicit consent from over a dozen different
• 6:57
  people he knew, searched the dark web database
• 7:00
  for their information, and successfully located
• 7:02
  nine of their licenses in the dump. Which is
• 7:05
  the crucial first step. Now he has a controlled
• 7:07
  sample group to analyze rather than 150 million
• 7:10
  random data points. From there, he looked at
• 7:13
  the file names. Remember those exact timestamps
• 7:15
  appended to the six images? Yeah, the date and
• 7:17
  time. He took those timestamps and correlated
• 7:21
  them with his sample group. He asked those people
• 7:23
  to check their emails and receipts and matched
• 7:26
  the exact date and time in the file to the exact
• 7:29
  moments those specific people had physically
• 7:32
  handed their IDs to a business. And what did
• 7:35
  he find? Overwhelmingly, these timestamps matched
• 7:38
  the exact moments they were standing at car rental
• 7:41
  counters. That behavioral correlation is just,
• 7:44
  it's the key to unlocking the whole mystery.
• 7:46
  And the detail here is stunning. Two federal
• 7:49
  employees in his sample data set had been traveling
• 7:52
  for work. They used their passports to get through
• 7:54
  airport security. But when they finally got to
• 7:56
  their destination, they handed their driver's
• 7:59
  licenses to a higher car company at the desk.
• 8:02
  Right. Only their driver's licenses were in the
• 8:04
  Nexus dump. Their passports were completely safe.
• 8:07
  Wow. And the timestamp on the dark web files
• 8:10
  perfectly matched the minute they were at the
• 8:12
  rental car counter, not the airport. That's amazing.
• 8:14
  Furthermore, Krebs and his own mother handed
• 8:17
  their separate licenses to the exact same rental
• 8:19
  agent at the exact same time, and their file
• 8:22
  timestamps in the dark web dump were mere seconds
• 8:25
  apart. The precision there is remarkable. It
• 8:28
  completely isolates the physical point of compromise
• 8:31
  down to a single interaction. Here's where it
• 8:34
  gets really interesting. It's basically... Digital
• 8:37
  carbon dating. Oh, I like that. You are taking
• 8:39
  this anonymous artifact, the image file, and
• 8:41
  using the timestamp to pinpoint the exact moment
• 8:44
  of exposure. It's like finding a fossil and tracking
• 8:48
  it back to the exact second it was frozen in
• 8:50
  stone, you know, in the hands of a specific vendor.
• 8:53
  Digital carbon dating is a great way to conceptualize
• 8:56
  the mechanism. You are tracing the artifact back
• 8:58
  to its exact origin point in time and space.
• 9:01
  Yeah. But while that behavioral timestamp correlation
• 9:04
  is incredibly powerful on its own, it is the
• 9:07
  technical smoking gun. that really narrows the
• 9:10
  focus of the investigation. Because Krebs looked
• 9:13
  at the specific, highly unusual capability of
• 9:15
  capturing those six images, normal, infrared,
• 9:18
  and ultraviolet light, he traced that hardware
• 9:20
  capability to a company called IDscan .net. They
• 9:24
  are an identity verification company headquartered
• 9:26
  in New Orleans, and they are massive. Very massive.
• 9:30
  They process a staggering 21 million verifications
• 9:34
  a month across more than 20 ,000 locations. In
• 9:39
  their own technical documentation, they specifically
• 9:41
  boast about scanning documents using infrared
• 9:45
  and ultraviolet light. Which is a highly uncommon
• 9:47
  capability for standard commercial scanners.
• 9:49
  Yeah, I'd imagine. Your average $50 flatbed scanner
• 9:52
  at a small business does not have infrared and
• 9:55
  ultraviolet bulbs in it. Right, of course not.
• 9:57
  It requires specialized hardware integrated with
• 10:00
  specialized software. And that capability perfectly
• 10:02
  matches the unique six image architecture of
• 10:05
  the records found in the dark web dump. It's
• 10:07
  quite a coincidence. The combination of the digital
• 10:09
  carbon dating and this rare technical capability
• 10:11
  is incredibly compelling investigative work.
• 10:14
  However. We have to put our analytical hats on
• 10:17
  here. Right. We have to be clear. Yes. And state
• 10:19
  clearly that in a legal sense is technically
• 10:22
  still circumstantial evidence. Because the evidence
• 10:25
  is compelling but circumstantial, we have to
• 10:27
  look closely at how the accused company, the
• 10:30
  authorities and the broader corporate world reacted
• 10:33
  in the crucial 48 hours following this discovery.
• 10:36
  Because once this was published. Things moved
• 10:39
  unbelievably fast. Faster than almost any standard
• 10:42
  cybersecurity incident timeline I've seen. Yeah.
• 10:44
  Following the publication of the investigation
• 10:46
  on September 1st, the FBI's New Orleans field
• 10:49
  office immediately opened an active probe. Wow,
• 10:53
  that fast. Within hours of the story dropping,
• 10:55
  the Nexus dark website completely vanished. Just
• 10:58
  gone. It was replaced with a generic message
• 11:00
  saying the service was no longer available. So
• 11:03
  they knew they were caught. Exactly. And the
• 11:05
  very next day, four separate class action lawsuits
• 11:08
  were instantly filed in federal court against
• 11:10
  IDscan .net. So you have the federal government
• 11:13
  and massive civil litigation moving in a matter
• 11:16
  of hours. The speed of that legal and federal
• 11:18
  response is a direct reflection of the severity
• 11:21
  and the sheer volume of the data involved. But
• 11:24
  this is where we must insert professional qualifiers.
• 11:26
  IDscan .net has not confirmed a breach of their
• 11:29
  systems. They have publicly stated they are urgently
• 11:32
  investigating to validate the information. They
• 11:35
  have confirmed they've secured their systems,
• 11:37
  preserved their logs, engaged outside digital
• 11:40
  forensics and legal counsel, and are working
• 11:43
  directly with law enforcement. So they're taking
• 11:45
  it seriously. Yes, but they have not reached
• 11:47
  a conclusion about the scope, the nature, or
• 11:50
  the validity of the incident. In the eyes of
• 11:53
  the law and professional analysis, this remains
• 11:55
  an allegation. It is not a proven fact. A court
• 11:59
  of law or a final forensic report will ultimately
• 12:01
  decide what happened. And neither of those things
• 12:03
  has happened yet. Correct. But the fallout in
• 12:06
  the meantime has been absolute chaos, which leads
• 12:09
  us to a fascinating lesson in corporate reaction.
• 12:12
  Oh, the logo trap. Yes. Early news coverage of
• 12:15
  this story wrongly implicated several massive
• 12:17
  global brands, suggesting they were direct victims
• 12:20
  of the breach simply because their corporate
• 12:22
  logos were featured on IDscan .net uses customer
• 12:25
  page. Yeah, that was a mess. Caesars Entertainment,
• 12:29
  for instance, had to aggressively and publicly
• 12:31
  push back. They stated they stopped using the
• 12:34
  relevant product entirely 18 months prior. in
• 12:37
  February 2025 that they had no active accounts
• 12:40
  and they emphatically stated they never authorized
• 12:42
  data retention in the first place. Right. But
• 12:44
  I have to ask, how does that even happen? If
• 12:48
  a massive company like Caesars cut ties 18 months
• 12:51
  ago, how did they get dragged into a PR nightmare
• 12:54
  like this overnight? This raises an important
• 12:56
  question about third party risk and what we might
• 12:59
  call the logo trap in technology marketing. The
• 13:02
  logo trap. Yeah, if a business has ever put a
• 13:04
  client's logo on their website, or if a company
• 13:07
  has allowed their logo to be put on a vendor's
• 13:09
  website, they know exactly how this works. It's
• 13:12
  just for show. Exactly. Marketing departments
• 13:14
  love to showcase recognizable brands to build
• 13:16
  trust. Yeah. But those static web pages are rarely
• 13:19
  audited or updated when contracts expire. Oh,
• 13:22
  I see. So in the first 24 hours of a cyber incident,
• 13:26
  journalists and automated web scrapers are frantically
• 13:28
  looking for angles. And they find the logo page.
• 13:31
  They pull that logo page. Suddenly, a brand is
• 13:34
  splashed across the headlines as part of a 150
• 13:38
  million record data breach, completely inaccurately.
• 13:43
  Misinformation spreads like wildfire in that
• 13:45
  initial vacuum of hard facts. The Caesars correction
• 13:48
  is actually the perfect pivot for us because
• 13:50
  it proves that this deep dive isn't just about
• 13:53
  one specific vendor's alleged security failure.
• 13:56
  It exposes a massive structural flaw in how every
• 14:00
  single business handles the IDs that you, the
• 14:03
  listener, hand over to them. Precisely. This
• 14:05
  is a story about the real estate agent taking
• 14:07
  a photocopy of your license for a tenancy application,
• 14:10
  the corporate recruiter doing a background check,
• 14:12
  the local gym, the accountant. Anyone. If a business
• 14:15
  verifies identity in any capacity. This is their
• 14:19
  risk profile. Which means we need to shift the
• 14:21
  conversation to the four hard, critical questions
• 14:24
  of data reality that businesses and the customers
• 14:27
  who use them must start asking immediately. Let's
• 14:30
  break them down. Sounds good. Question number
• 14:31
  one, do you still have them? Meaning, do you
• 14:34
  still have the data you collected? And this is
• 14:37
  often the most quietly devastating question a
• 14:39
  business can ask itself. Why is that? Because
• 14:42
  the biggest risk isn't necessarily a sophisticated
• 14:45
  Russian dark web syndicate hacking into a highly
• 14:48
  secure server. It's the mundane reality of a
• 14:52
  business keeping a digital copy of a driver's
• 14:55
  license from 2019 sitting in a random 2026 email
• 15:00
  inbox. Or a neglected shared cloud drive. Yeah.
• 15:04
  Simply because no one ever wrote a policy to
• 15:06
  hit the delete button. So what does this all
• 15:08
  mean? It reminds me of handing over a house key
• 15:10
  to a plumber. OK, I'm listening. Keeping a 2019
• 15:13
  ID in a 2026 inbox is like making a copy of your
• 15:17
  front door key for a plumber to fix a leak. And
• 15:19
  then the plumber just leaves that key sitting
• 15:21
  on the public sidewalk for seven years. That's
• 15:23
  horrifying. Right. Your locks haven't changed,
• 15:26
  but your exposure is now infinite. Someone is
• 15:28
  eventually going to step on it. It's like leaving
• 15:30
  a rusty bear trap in your hallway. That is a
• 15:32
  perfect analogy for the mechanism of data liability.
• 15:36
  If we connect this to the bigger picture, holding
• 15:39
  on to data you no longer need. isn't just bad
• 15:42
  practice in many global jurisdictions. It is
• 15:45
  a direct violation of the law. Really? Yes. For
• 15:48
  example, if you look at frameworks like the GDPR
• 15:51
  in Europe or specific rules like Australian Privacy
• 15:54
  Principle 11 .2, you are legally mandated to
• 15:57
  destroy or completely de -identify personal information
• 16:01
  the second you no longer need it for the purpose
• 16:03
  you collected it. It's not just a suggestion.
• 16:05
  No, it's not a gentle suggestion from a regulator.
• 16:07
  It's a legal requirement. Deleting unneeded data
• 16:10
  is unquestionably the single most effective cybersecurity
• 16:13
  control any business can implement. Because you
• 16:16
  can't steal what isn't there. Exactly. You physically
• 16:19
  cannot leak what you do not possess. Which brings
• 16:21
  us to question two. Where does the scanner actually
• 16:24
  send the image? This is a fundamental misunderstanding
• 16:26
  many business owners have. They assume that data
• 16:29
  routing is a technology question. Right. It is
• 16:32
  not. It is entirely a contract question. What
• 16:34
  do you mean by that? How is a data transfer a
• 16:36
  contract issue? Because the technology just does
• 16:39
  what the contract allows. When you plug in a
• 16:42
  third -party scanner at your front desk, are
• 16:45
  those images being kept on your company's terms
• 16:47
  or on the vendor's terms? Oh, I see. Do you actually
• 16:50
  know where the image is stored, for exactly how
• 16:53
  long, and who the subprocessors are? Wait, what
• 16:56
  is a subprocessor in this context? A subprocessor
• 16:59
  is the vendor's vendor. So you hire a verification
• 17:02
  company, but they rent server space from Amazon
• 17:04
  Web Services, and they use a different company
• 17:07
  for their data backups. The web just expands.
• 17:09
  The chain of custody gets incredibly complex.
• 17:12
  If your direct contract with the vendor doesn't
• 17:15
  explicitly dictate the retention period and mandate
• 17:18
  total deletion upon termination of the contract,
• 17:21
  then the answer to where your data lives is simply
• 17:23
  whatever the vendor decides. That's terrifying.
• 17:25
  You've outsourced your compliance, but you have
• 17:27
  kept 100 % of the liability. Which leads into
• 17:30
  question three, and this one seems so glaringly
• 17:33
  obvious in hindsight. Could you just collect
• 17:36
  less data in the first place? Why are we saving
• 17:38
  high -resolution images to begin with? It is
• 17:41
  the question that saves a company the most money
• 17:43
  and reduces the most risk, yet it gets asked
• 17:46
  the least. Why? Because saving everything is
• 17:49
  usually the default setting on these software
• 17:51
  platforms. For a vast majority of identity checks,
• 17:54
  a business only needs to verify a document in
• 17:56
  that specific fleeting moment. Like at a hotel.
• 17:59
  Exactly. A hotel just needs to know you are who
• 18:02
  the reservation says you are. They do not need
• 18:05
  to keep a high -resolution, six -spectrum, infrared
• 18:07
  image of your license on file for a decade. That
• 18:10
  makes sense. Simply recording a text log that
• 18:13
  a check was successfully performed on this date
• 18:16
  by this specific employee against this document
• 18:18
  number is often completely legally sufficient.
• 18:22
  Substituting a simple text verification record
• 18:24
  for an actual replicable image fundamentally
• 18:27
  changes your entire liability profile. And finally,
• 18:30
  question four, the hardest question of all. What
• 18:33
  would you actually do in a breach? If your system
• 18:35
  was compromised tomorrow, could you tell the
• 18:38
  authorities exactly how many documents were in
• 18:40
  it, whose they were, and exactly how old they
• 18:42
  were? That is the very first question any privacy
• 18:45
  regulator is going to ask. And answering, we're
• 18:48
  not entirely sure, is an incredibly expensive
• 18:50
  response. I bet. The legal landscape is shifting
• 18:53
  rapidly here. There are new privacy regulations
• 18:56
  being proposed globally, including exposure drafts
• 18:59
  discussed in our sources, that would put in a
• 19:01
  hard 72 -hour clock on notifying the relevant
• 19:04
  privacy commissioners of a breach. 72 hours is
• 19:08
  nothing. It's incredibly fast. You physically
• 19:10
  cannot meet a 72 -hour legal deadline to report
• 19:14
  a breach if you don't even know where your scanned
• 19:16
  IDs are stored or how many you have. Right. And
• 19:19
  because identity document images are the literal
• 19:21
  raw material for identity theft, establishing
• 19:24
  that the breach caused serious harm. in a legal
• 19:27
  sense, is almost guaranteed. It's a ticking time
• 19:29
  bomb for literally anyone with a scanner sitting
• 19:31
  at the front desk. It truly is. And zooming out
• 19:34
  from the corporate responsibility, there is a
• 19:36
  massive looming macro trend here. There is a
• 19:40
  major policy conflict buried underneath this
• 19:43
  entire story that we really need to acknowledge.
• 19:46
  Right now, governments all over the world are
• 19:49
  aggressively pushing for mandatory identity verification
• 19:52
  for a much wider range of everyday online activities.
• 19:57
  Oh, like age verification. Yes. We are seeing
• 19:59
  major legislative proposals for mandatory age
• 20:02
  verification to access certain websites, mandatory
• 20:05
  ID checks to open social media accounts, and
• 20:08
  tighter financial KYC, you know, know your customer
• 20:11
  regulations. And just to be clear, we aren't
• 20:13
  taking a side on whether those... specific government
• 20:16
  policies are good or bad, but the sheer mechanics
• 20:18
  of implementing them are obvious. If you have
• 20:20
  more gates, you need more keys. Exactly. Regardless
• 20:23
  of the political intent, the mechanical consequence
• 20:25
  of those policies is inevitable. Vastly more
• 20:28
  of your personal, highly sensitive identity documents
• 20:31
  are going to flow into third -party vendors.
• 20:33
  Yeah. They're going to sit in front desk scanners
• 20:36
  and remote cloud servers operated by thousands
• 20:38
  of different businesses, many of which have absolutely
• 20:40
  zero data retention policies in place. It's just
• 20:43
  a recipe for disaster. Every single new verification
• 20:46
  requirement is an exponential expansion of the
• 20:49
  attack surface for criminals. Before we wrap
• 20:52
  up, I need to issue a very quick, very important
• 20:55
  warning for you listening to this deep dive.
• 20:57
  With a breach this massive, over 150 million
• 21:01
  records, you might be tempted to go looking for
• 21:04
  a website to check if your specific ID was caught
• 21:07
  up in it. Don't do it. Do not do that. Our sources
• 21:10
  are explicitly clear. The Nexus dark web shop
• 21:13
  went offline, but the underlying database didn't
• 21:16
  just evaporate. No, it's still out there somewhere.
• 21:18
  There is currently no legitimate, secure public
• 21:21
  lookup service where an individual can check
• 21:23
  their status for this specific dump. Exactly.
• 21:26
  If you see a random website offering to check
• 21:28
  if your ID is in the Nexus breach, do not type
• 21:31
  your information into it. Those are very often
• 21:33
  secondary phishing scams designed to harvest
• 21:36
  the exact sensitive data you are trying to protect.
• 21:38
  It is a secondary trap that preys on anxiety,
• 21:41
  and it leaves us all in a deeply precarious position.
• 21:44
  It really does. I want to leave you with a final
• 21:46
  thought to mull over, something that really builds
• 21:48
  on everything we've unpacked today about the
• 21:50
  intersection of physical plastic and digital
• 21:52
  data. Okay, let's hear it. We started by talking
• 21:55
  about the physical nature of handing over a card.
• 21:57
  Yeah. need to be completely reinvented wow has
• 22:24
  the technology of digital forgery officially
• 22:27
  outpaced the technology of plastic cards that
• 22:30
  is a heavy structural question and it completely
• 22:33
  reframes how we have to think about who we are
• 22:35
  on paper or on plastic thank you so much for
• 22:38
  joining us on this deep dive into the hidden
• 22:40
  life of your personal data i can guarantee this
• 22:43
  the next time you're standing at that Higher
• 22:46
  car counter or checking into that hotel and that
• 22:48
  little plastic scanner flashes its light You
• 22:51
  are gonna think twice about exactly where that
• 22:53
  digital ghost is going. We'll see you next time