IDMerit data breach: 1 billion records of personal data exposed in KYC data leak
cybernews.com
A massive global data leak linked to IDMerit has exposed 1 billion personal records, including national IDs and emails, across the US, Europe, and Asia.
  • sylver_dragon@lemmy.worldEnglish
    141·
    2 months ago

    This one is a mixed bag. KYC regulations are very useful in detecting and prosecuting money laundering and crimes like human trafficking. But ya, if this data needs to be kept, the regulations around secure storage need to be just as tight. This sort of thing should be required to be kept to cybersecurity standards like CMMC Level 3, audited by outside auditors and violations treated as company and executive disqualifying events (you ran a company so poorly you failed to secure data, you’re not allowed to run such a company for the next 10 years). The sort of negligence of leaving a database exposed to the web should already result in business crippling fines (think GDPR style fines listed in percentages of global annual revenue). A database which is exposed to the web and has default credentials or no access control at all should result in c-level exec seeing the inside of a jail cell. There is zero excuse for that happening in a company tasked with protecting data. And I refuse to believe it’s the result of whatever scape-goat techs they try to pin this on. This sort of failure always comes from the top. It’s caused by executives who want everything done fast and cheap and don’t care about it being done right.

    • Static_Rocket@lemmy.worldEnglish
      2·
      2 months ago

      I’m uninformed about this, but do KYC laws come into effect at some profit point or are they globally enforced. I don’t see how any small businesses could possibly afford a 3rd party audit, or how that would even scale. I agree it’s necessary, but logistically it seems problematic.

        • Static_Rocket@lemmy.worldEnglish
          1·
          2 months ago

          Ah, makes sense it would be targeted twards banking and financial businesses specifically. Better pinch point than some random commerce. In that case audits would be less problematic, though I’m not sure why outsourcing this data is even an option with the current rules. It’s not like a business can be completely hands off in the acquisition or processing of that info.

  • Ulu-Mulu-no-die@lemmy.zipEnglish
    7·
    2 months ago

    In a catastrophic security failure, an AI-powered tool used by IDMerit, a global leader in digital identity verification, has exposed a staggering one billion personal records

    Didn’t it happened already that AI seriously compromised a production database? Will people ever learn?

        • Vex_Detrause@lemmy.ca
          5·
          2 months ago

          If you gather all ropes, crowbars and knives then don’t stop the criminal from getting access then it’s the gov’t fault. It’s better if they just leave all those private knives alone and not gather it to one spot.

        • herseycokguzelolacak@lemmy.mlOP
          21·
          2 months ago

          KYC laws resulted in the personal data of a billion people leaking. Criminals and scammers will use this data to cause much harm.

          Yes, I can condemn supporters of KYC laws for their incompetence and stupidity. This was obviously going to happen at some point. If you stockpile data, it eventually leaks.

    • fizzle@quokk.auEnglish
      4·
      2 months ago

      The Post Title Says “12M Aussies personal data leaked - and 1 Billion worldwide”.

      That’s not really sensational, it’s two facts included in the article. Sensational would be “12m Aussies hacked” or something, implying something entirely different.

      There’s no assertion from the article or the title that KYC shouldn’t happen - you seem to be imagining that.

      However, if a service uses a third party to collect and store KYC data then that third party needs to take reasonable steps to safe guard that data.