Identity Verification Used by X, TikTok, and Uber Exposed Driver's Licenses

An identity verification firm, AU10TIX, utilized by companies like X, TikTok, and Uber, inadvertently exposed administrative login credentials to the internet for over a year. This security lapse could have allowed unauthorized access to sensitive user information, such as images of American driver's licenses. AU10TIX typically requests various identifying data points, like selfies and government-issued ID pictures, to verify users on platforms. The breach originated from an AU10TIX employee's compromised login credentials, which were then shared on a Telegram channel. Despite AU10TIX's claim that the incident occurred over 18 months ago and that the credentials were promptly revoked, a cybersecurity researcher found that the credentials were still functional. AU10TIX stated they were shutting down the system associated with the compromised credentials and assured that there was no evidence of data exploitation. The company has partnerships with several major platforms and brands, including PayPal, LinkedIn, and Coinbase.