Don't worry I'm sure the government is working overtime to draft a new law requiring companies to collect even more personal info. They've got us covered

The fact this database even exists is pretty dubious from a data sovereignty point-of-view.

Sadly I see a lot of victims of scams / identity fraud in my work.

My advice to people generally is:

Be vigilant, don't click links in emails, don't talk to people who call you, have conversations with the people you care about reminding them to also be vigilant.

For access to government services, set up the myId app for 2fa, don't use SMS.

For other services, use a 2fa code generator, or SMS if that's all thats available.

Use a password manager, but be wary that non-technical people might find this out of reach. Their browser's built in password management is better than nothing.

Your State's department of transport probably lets you lock your profile so your drivers license number can't be used to verify your identity. Be aware that you'll need to unlock this when you want to allow someone to confirm your id.

Similarly you can lock your credit rating at experian or equifax:

• https://www.experian.com.au/consumer/request-a-ban
• https://www.equifax.com.au/eform/submit/credit_ban03

Now I have to go and get a new gender

So nearly half the population (assuming do duplicates)? Fuck me dead.

Any idea how long until Have I Been Pwned is updated?

And it’s all part of ai training data now too.

I used to wonder when I watched “Star Trek TNG” as a kid, how they could ask for and get such detailed biographical information of a long dead person, enough to recreate that person convincingly, in a holodeck. Well, I guess I have my answer.

I really thought I’d be living in something like the federation one day, instead I’m here boning up on the Ferengi Rules of Acquisition.

I think about this kind of simplistically.

Firstly, answer to yourself is it practically possible to store and use vast amounts of data safely, without risk of being compromised?

If you say no, then we shouldn’t be doing this. If you said yes:

Since you think it is practically possible to do safely, the penalty for any company who fails to do this should be instant corporate death. Automatic nationalization and liquidation to compensate the victims. People who are found in court to be responsible should face severe consequences. Criminal negligence, multiple counts.

That’s the only way I see to get all of these data hoarding fucks to take it seriously.

/end pipe dream

60m records in Germany. That 3/4 of the population. The US has 350m inhabitants. 200m leaked records accounts for more than half!

Fucking LOL. https://www.idmerit.com/blog/idmerits-data-breach-fail-safe-architecture-game-changer/

They should publish the names of the companies which datasets have been involved. NOW.

If everyone is selling my personal information and I'm not getting my cut then I see a class action lawsuit in the not too distant future. Who's with me?

Why the hell would you use an AI tool for giant data sets of sensible data? Someone needs to go to jail and that company shouldn‘t exist any longer.

Last week, we published our team's findings about an exposed Elasticsearch cluster that contained over 160 indices and held 8.7 billion primarily Chinese records, ranging from national citizen ID numbers to various business records.

Last December, the team uncovered an unprotected database containing 4.3 billion records, some of which included LinkedIn-derived personal information. The 16TB-strong instance contained emails, photos, employment histories, and other personal data. A single collection alone contained 732 million records, including photographs.

In July, Cybernews covered one of the largest data leaks in history, after researchers discovered several collections of login credentials, containing 16 billion records. The team found 30 exposed datasets, each containing tens of millions to more than 3.5 billion records.

The leaked data included login info for just about every online service, including Apple, Facebook, Google, GitHub, Telegram, and even government platforms.

Damn....

This happens every now and then, new or old data, several accounts, sometimes billions. Far too frequently.

The Cybernews research team discovered an exposed MongoDB database containing nearly 1 terabyte of personally identifiable information (PII) exposing approximately a billion sensitive records across 26 countries.

Welp. I guess, time to change passwords.

Is this why my phone was suddenly enrolled in half a dozen text notification services at the same time last week? Or was that a different massive-scale data leak? It's hard to keep track at this point.

At some point so much data will have been leak that there will be no new data to leak, right?

“At this scale, downstream risks include account takeovers, targeted phishing, credit fraud, SIM swaps, and long-tail privacy harms. Industry-wide, the case underlines how third-party identity vendors have become critical infrastructure and can become single points of catastrophic failure,” our team explained."

Wouldn't Username + Password + SIM = 2FA password reset?

The core purpose of KYC - to make it harder to launder money, and for the ultra rich to hide away their ill gotten gains - is not evil, far from it.

The fact the very same people which benefit from a perception that KYC is evil and/or ineffective, are the same people making the decisions to penny pinch on security which directly lead to data breaches, is obviously a complete coincidence!

KYC isn't evil. It's literally the operational piece that says stuff like "If someone named Vladimir Putin tries to open a bank account with you, you should know if he's THAT putin or not, especially as it may get your business in serious trouble related to gov sanctions etc". The government, quite literally, sends auditors to Banks and Credit Unions every 2-3 years to make sure you do this sort of due diligence.

The issue with KYC is that it's farmed out to third parties that focus on scale and cutting costs. It's in the same general space as something like Credit Scores -- Banks/Credit Unions don't maintain their own credit scores for people so much, as they just buy that score information from Equifax / Transunion etc.

Really, what I imagine people should be pushing for instead of this piecemeal whining, is something closer to what Estonia has for its citizens. A highly integrated government-based portal that allows citizens to do things like Register a New Small business in 15 minutes, and to see which organisations have access to their gov ID info. From what I understand, citizens basically get given PINs as part of their gov IDs, which they can disclose to banks/businesses, who can subsequently access basic required read-only details about that person via the gov portal. So your bank needs to know who you are? No problem, you let them know your pin when you setup the account -- and the banks system is then able to pull just the basic info from your gov account to meet the banks operational needs / regulatory obligations whether you're there in person or not. And as a citizen, if you want to check your privacy disclosures to third parties, you just log in to the gov site, and see a list of which businesses have access to your data -- and I imagine you'd get the option to cancel their access if you wanted to (so when you close an account at a business, you pop in to the gov site and also clip their ongoing access). From what I gather, that sites a one stop shop for all gov stuff, so it's also where you go for tax stuff, drivers lics, the works. Makes it a LOT simpler for citizens, as you don't need to sort out what esoteric stupid sub site / domain you need to visit to see if you qualify for a rebate or whatever -- so it seems like a big improvement from a user experience side.

ALL THAT SAID, that shift would put more onus on the consumer in some ways, as they'd need to log in to a gov site etc -- like it's bad enough trying to explain MFA to old people, imagine trying to make this shift! You'd also need a government that was willing to actually do stuff for the people -- I think Estonia only went that way, as an attempt to shield themselves from massive attacks from Russia. They want their gov fully functioning in the cloud, including elections etc, so that even if they end up like Ukraine, they can still "function" remotely. Consumers are a big issue for anything security related too, as practically no one changes banks / FIs based on security -- it's almost entirely rate oriented for mortgage holders. Tell a consumer they can get a 0.2% better rate by going with the bank that doesn't fuss security, they'll take it. Try and market your bank/FI as being more security conscious, it won't generally draw in new members based on that alone.

Like, again using Canada as an example, we've had a year of the US antagonizing us and threatening economic ruin / annexation. Lots of Canadians are keen not to buy American products as a result. Almost all of Canadas banks/CUs use US partners/outsourcing within their stack: places like Vancity Credit Union, for example, are using Intellect Design's product for their online banking, which is a partner owned by an India parent company (with little/no presence in Canada), which hosts its stuff on Microsoft's cloud. Most Credit Unions in the country are likely going to go the same way in the next couple years -- even though it's a huge security risk, and highly likely that both India and the USA will gain access to all your data, let alone sketchy third party's like India's fraud centers. There are a couple Credit Unions in Canada that actually maintain stuff (almost entirely) in Canada. But that's not enough to entice people to use those organisations, so they're all dying out / merging as a result of a lack of members (and regulatory overreach / decrees).

Anyway to check if my data has been leaked or should everyone just assume yes?

This one is a mixed bag. KYC regulations are very useful in detecting and prosecuting money laundering and crimes like human trafficking. But ya, if this data needs to be kept, the regulations around secure storage need to be just as tight. This sort of thing should be required to be kept to cybersecurity standards like CMMC Level 3, audited by outside auditors and violations treated as company and executive disqualifying events (you ran a company so poorly you failed to secure data, you're not allowed to run such a company for the next 10 years). The sort of negligence of leaving a database exposed to the web should already result in business crippling fines (think GDPR style fines listed in percentages of global annual revenue). A database which is exposed to the web and has default credentials or no access control at all should result in c-level exec seeing the inside of a jail cell. There is zero excuse for that happening in a company tasked with protecting data. And I refuse to believe it's the result of whatever scape-goat techs they try to pin this on. This sort of failure always comes from the top. It's caused by executives who want everything done fast and cheap and don't care about it being done right.

This is genuinely grim

In a catastrophic security failure, an AI-powered tool used by IDMerit, a global leader in digital identity verification, has exposed a staggering one billion personal records

Didn't it happened already that AI seriously compromised a production database? Will people ever learn?