Identity Theft

Attackers misused a Danish company's authorised CPR access to harvest names, addresses and CPR numbers on about 8.8 million people — roughly 80% of the national register — over ten days in September 2026, found only when an outsized lookup bill appeared.

Two former US airmen got 111 and 78 months for a BEC and card-fraud scheme that diverted $1.68M and $720K wires. The docket shows conspiracy pleas, overlapping restitution and a pending appeal; 15 victims and $2.4M are not DOJ figures.

A $16M forfeiture filing this week named five convicted Scattered Spider defendants. The court docket shows two of them — reported this month as "still facing charges" — were sentenced months ago, and that Elbadawy's own "October 2025 guilty plea" was, on the public record, a not-guilty plea.

ShinyHunters claimed Florida's DAVID law-enforcement database on 7 September with Jeffrey Epstein's record as proof. The state says one Plant City police credential stored on a personal device was the way in; the attackers say a password-reset flaw across multiple accounts. Both may be true.

A dark-web service called Nexus sold infrared and ultraviolet scans of 153 million North American driver's licences, traced by Krebs to identity-verification vendor IDScan.net. The vendor's own documentation shows its cloud retained every scan indefinitely by default.

For 17 days in August 2026 an attacker registered Lenovo IDs on other people's email addresses and signed straight into their Dropbox accounts. Lenovo's verification was the flaw; Dropbox's willingness to trust it without a password was the breach.

A Russian web developer extradited from Georgia faces trial over a 2023–25 operation that bought search ads impersonating banks, harvested 5,000+ logins and 2FA codes on cloned pages, and tried to wire $5.58 million from one Atlanta company in a day. The mule LLC was registered in Georgia two months

The transition of the global cyber threat landscape from traditional network intrusions to decentralized, identity-centric attacks is exemplified by the RedLine infostealer. First identified in March...