Data was continuously exfiltrated from IDScan.net for over a year

Assessment

The statement is the Nexus seller's, quoted by Krebs from the Exploit post: "We have been continuously exfiltrating new data for over a year into our private database." Two observations are consistent with it: Krebs's own licence carries a June 2025 timestamp, and the inventory grew by roughly 400,000 records during the 24 hours before publication. Neither establishes when access began. IDScan.net's notice says it "received information" on or around 1 September 2026 and gives no intrusion date. The claim is plausible and unconfirmed by the only party able to confirm it.