Human In[Security] – Week of 2026-09-07

Today’s Menu (30-second skim)

• A dark-web identity shop is selling millions of driver’s license scans: Millions of license scans may be for sale, giving scammers better tools to pretend they are you.
• Trezor wallet customer breach now affects 81,000 people: A shipping data breach exposed crypto customers’ contact details, which can fuel targeted wallet scams.
• Court software breach may have exposed Social Security numbers and sealed records: A court software incident may have exposed sensitive personal and legal records across several places.

1) A dark-web identity shop is selling millions of driver’s license scans

What happened (plain English): KrebsOnSecurity reported that a new identity-theft service is selling scans of more than 153 million driver’s licenses from people in the United States and Canada. The service says it also has millions of other identity documents, including ID cards, travel papers, and medical cards. The FBI’s New Orleans office has opened an inquiry into where the images came from. The report says the documents may have come from an identity-checking company used by businesses that scan IDs. In plain English, pictures people handed over to prove who they are may now be helping criminals do the same thing.

Why it matters to you: A driver’s license photo is not just a picture. It can help a scammer open an account, get past a customer support check, or make a fake problem sound real. For example, someone could call your phone company and use your name, address, birth date, and license image to try to take over your account. Or they could text you after a breach and say you need to upload your license again, hoping you will send an even clearer copy.

How to protect yourself (do this):

• Freeze your credit with Equifax, Experian, and TransUnion if you are worried your identity documents were exposed.
• Be suspicious of any call, email, or text claiming you need to “verify your license” after a breach.
• Do not upload a photo of your ID through a link someone sends you. Go directly to the company’s real website or app.
• Check your credit reports and financial accounts for new accounts or changes you did not make.

Published: 2026-09-08

Source: KrebsOnSecurity

2) Trezor wallet customer breach now affects 81,000 people

What happened (plain English): Trezor, a company that makes hardware wallets for cryptocurrency, says a breach at its shipping and logistics provider affected another 67,000 U.S. customers. That brings the total number of affected customers to about 81,000. The exposed information included names, shipping addresses, email addresses, and phone numbers. Trezor says the breach involved order and shipping data, not the secret recovery phrases that control customers’ crypto wallets. That is good news, but the stolen contact list is still useful to criminals.

Why it matters to you: Crypto scams work best when they feel personal and urgent. A criminal who knows you bought a Trezor wallet can send an email or text that looks like real support and includes your real name or address. One scam might say your wallet needs a security update and ask you to type in your recovery phrase. Another might pretend to be a delivery or refund notice and push you to click a link before you have time to think.

How to protect yourself (do this):

• Never type your crypto wallet recovery phrase into a website, support chat, email form, or phone app.
• Ignore messages that say your wallet must be “verified,” “synced,” or “secured” through a link.
• Go to Trezor’s website by typing the address yourself, not by clicking a message.
• Be extra cautious with delivery, refund, or support messages that include your real name or address.

Published: 2026-09-07

Source: BleepingComputer

3) Court software breach may have exposed Social Security numbers and sealed records

What happened (plain English): C-Track, a court case-management platform owned by West Publishing Corporation, posted a notice about unauthorized access to certain files. The notice says the incident affected court systems in multiple U.S. states, the U.S. Virgin Islands, and Ontario, Canada. Some affected records may include names, Social Security numbers, driver’s license numbers, dates of birth, medical information, and health insurance information. The notice also says some confidential, redacted, or sealed information may have been involved. That means some information people expected to stay private may have been exposed.

Why it matters to you: Court records can include some of the most personal details in a person’s life. Scammers can use real case details to sound scary, official, and believable. Someone could pretend to be from a court and say you must pay a fee today to avoid a warrant. Someone else could pretend to be a lawyer, collector, or government worker and repeat real personal facts to pressure you into giving money or more information.

How to protect yourself (do this):

• If you get a court-related call or message asking for money or personal information, hang up and contact the court using a number from its official website.
• Consider using the free credit monitoring offered in the official notice if you may be affected.
• Place a fraud alert or credit freeze if your Social Security number or driver’s license number may have been exposed.
• Save copies of breach notices, letters, and suspicious messages in case you need to report identity theft later.

Published: 2026-09-02

Source: C-Track / West Publishing Corporation

Grandma’s Firewall

This week’s simple rule: When a breach is in the news, do not trust the people who contact you first. Real help starts when you use a number or website you found yourself.

Two scripts you can steal:

• “I’m not handling this from a text or email. I’ll go to the company’s real website myself.”
• “If this is really from the court, bank, or company, I’ll call back using the official number – not the one in this message.”