The Trust Page Came Down

A dark web service began selling scans of more than 153 million driver's licenses from the United States and Canada, alongside identification cards, travel documents and medical cards. Brian Krebs traced the collection to IDScan.net, an identity verification company in New Orleans, by cross-referencing timestamps on the stolen images against his own travel records.2 The FBI's New Orleans field office opened an investigation.2

Read where those images came from. IDScan.net's technology sits at car rental counters, at retailers, and at more than a thousand marijuana dispensaries.2 Most of the people in that data did not hand their license to a bank. They handed it to a clerk, for a moment, at a counter.

The banking part is what happened next. IDScan.net's own trust page named its customers, including the core banking technology provider Jack Henry.2 After Krebs traced the scans to the company, the pages naming its bank and credit union integrations came down.1

Separately, and in the same week, Jack Henry itself was breached. The intrusion began with vishing, voice phishing, in which an attacker impersonates someone the target trusts and talks them into handing over credentials.5 The group ShinyHunters reached a non-production environment holding personally identifiable information belonging to fewer than ten client institutions.5 No client-facing applications, core processing platforms or daily transaction services were touched.5 Jack Henry was extorted and refused to pay.34

Those are two separate incidents connected by a commercial relationship, not one causing the other. What they share is a shape. Neither incident started at a bank. One started at the vendor holding the documents, the other at a person answering a phone.

Microsoft's security researchers spent the same week describing the method in detail: attackers impersonating IT support to convert a single remote session into enterprise-wide access,6 and counterfeit software installers carrying compromise into systems that asked for the download.7 Nothing exotic. Somebody was helpful to the wrong caller.

Meanwhile the industry kept building in the other direction. A Swiss bank ran a proof of concept using AI agents to speed up customer onboarding while holding its risk controls,8 and a compliance vendor shipped ready-made fraud decisioning for companies growing faster than their controls.9 Both are reasonable. Both also move more identity checking to a vendor, which is the layer that failed this week.

Banks do not own the identity they trust. They rent it, from companies their customers have never heard of, whose other customers are rental counters and dispensaries. That arrangement worked because nobody had to look at it. This week somebody looked, and the pages came down.