FlagThis — Daily Cybersecurity Intelligence Briefing

An identity verification (IDV) supply chain compromise allegedly targeting idscan.net has exposed between 153 million and 170 million driver's license records from the United States and Canada. Exfiltrated data consists of high-resolution digital scans of government-issued IDs and associated PII, including full names, dates of birth, and residential addresses. Technical investigations are currently targeting API endpoint exploitation, unauthorized third-party access tokens, or cloud storage misconfigurations as the primary breach vectors. This compromise creates systemic risk by undermining the KYC/AML integrity of downstream financial services, enabling high-fidelity synthetic identity fraud and sophisticated account takeover (ATO) attacks.

The financially motivated threat actor Breeze Comet (UNC5669) is conducting highly sophisticated attacks against the Brazilian financial sector, specifically targeting the PIX instant payment system. Unlike traditional fraud involving credential theft or forgery, Breeze Comet utilizes specialized modules to manipulate banking software and the transaction signing processes. By exploiting vulnerabilities in how retail e-commerce payment integrations and banking gateways handle transaction signatures, the actor executes hundreds of unauthorized transfers that appear technically valid. This exploitation poses a systemic risk to the integrity of the PIX infrastructure and the broader Brazilian e-commerce ecosystem.