It sure looks like hackers breached a major ID card verification service
It sure looks like hackers breached a major ID card verification service
看起来一家大型身份证件验证服务商遭到了黑客入侵
If you have handed over your driver’s license, passport, or other form of identity document to verify your information in the real world, like at a bar, a weed store, or when booking a car rental, there’s a good chance it’s now been stolen in a suspected massive data breach. 如果你曾在现实生活中（例如在酒吧、大麻商店或预订租车时）出示过驾照、护照或其他形式的身份证件来验证个人信息，那么很有可能你的信息已经在一次疑似大规模数据泄露事件中被窃取了。
That’s according to a jaw-dropping report by independent security journalist Brian Krebs, who says a company used to verify government-issued identity documents in the real world was likely hacked and its vast stores of people’s ID cards were exfiltrated. 这是独立安全记者布莱恩·克雷布斯（Brian Krebs）在一份令人震惊的报告中披露的。他表示，一家用于验证政府签发身份证件的公司很可能遭到了黑客攻击，其存储的大量个人身份证件信息已被窃取。
Krebs reports that an identity theft site called Nexus, which launched on the dark web this week, claimed to allow users to search through more than 150 million driver’s licenses and passports belonging to people who live in the United States and Canada. 克雷布斯报道称，一个本周在暗网上线的身份盗窃网站“Nexus”声称，允许用户搜索超过 1.5 亿份属于美国和加拿大居民的驾照和护照信息。
A post advertising the site on a known Russian cybercrime forum said Nexus added about half a million new documents daily, sourced from a “major identity verification company,” implying that the hackers had near real-time access to the identity verification company’s systems. 在一个知名的俄罗斯网络犯罪论坛上，该网站的广告帖称，Nexus 每天新增约 50 万份新文档，这些数据源自一家“大型身份验证公司”，这意味着黑客几乎可以实时访问该公司的系统。
The advert claims that “customer photos are displayed if available.” Krebs found that his own driver’s license was among the searchable records in the database, confirming that the data was authentic. 广告声称“如果可用，还会显示客户照片”。克雷布斯发现他自己的驾照也在该数据库的可搜索记录中，这证实了数据的真实性。
Secretary of Defense Pete Hegseth was also among the people whose photos were listed on the identity search site. A spokesperson for the Department of Defense told TechCrunch that it is “aware of these reports and is evaluating them.” 国防部长皮特·海格塞斯（Pete Hegseth）的照片也出现在该身份搜索网站上。国防部发言人告诉 TechCrunch，他们“已知悉这些报道，并正在进行评估”。
Working with security researcher Zach Edwards, whose ID card was also stolen in the breach, Krebs identified the likely source as the identity verification service IDScan. The Louisiana-based company is relied on by major tech and consumer brands to verify tens of millions of people’s IDs around the world each month. 克雷布斯与安全研究员扎克·爱德华兹（Zach Edwards）合作，确定了泄露源头很可能是身份验证服务商 IDScan。爱德华兹本人的身份证件也在这次泄露中被窃取。这家总部位于路易斯安那州的公司每月为全球各大科技和消费品牌验证数千万人的身份。
IDScan chief executive Jimmy Roussel did not return TechCrunch’s request for comment, but the company’s chief operating officer Jillian Kossman told Krebs that the company was investigating. Krebs said the FBI’s field office in New Orleans is also probing the breach. A spokesperson for the FBI did not respond to TechCrunch’s inquiry about the breach. IDScan 首席执行官吉米·鲁塞尔（Jimmy Roussel）未回应 TechCrunch 的置评请求，但该公司首席运营官吉莉安·科斯曼（Jillian Kossman）告诉克雷布斯，公司正在进行调查。克雷布斯表示，联邦调查局（FBI）新奥尔良外勤办公室也在调查此次泄露事件。FBI 发言人未回应 TechCrunch 关于此事的询问。
Nexus went offline shortly after Krebs’ report went live. This data breach comes as governments are increasingly rolling out age-verification laws, which largely rely on requiring adults to upload their identity documents to verify that they are old enough to enter a website or app. 在克雷布斯的报道发布后不久，Nexus 网站便下线了。此次数据泄露正值各国政府日益推行年龄验证法律之际，这些法律很大程度上依赖于要求成年人上传身份证件，以验证其是否达到进入网站或应用程序的年龄要求。
Security experts and privacy advocates have long warned that companies storing vast amounts of people’s identity documents for long periods of time put that data at risk of theft by hackers. By all accounts, this would be the largest known single breach of identity documents in some time. 安全专家和隐私倡导者长期以来一直警告称，公司长期存储大量个人身份证件会将这些数据置于被黑客窃取的风险之中。从各方面来看，这都将是近期已知规模最大的一次单一身份证件泄露事件。