Love Electric’s alleged data breach exposes sensitive driver data and highlights the identity risks created by third-party salary sacrifice providers.

A seller on an English-language data-breach forum claimed on August 26 that they had obtained the driver database of Love Electric, a UK broker that runs electric-vehicle salary sacrifice schemes. The seller, operating under the name “seraphims”, offered 877,000 records for $600 in cryptocurrency, with the price negotiable.

That headline number needs a qualification. Ransomnews researchers examined a 999-row sample published with the listing and found strong evidence that the sample came from a genuine production database, but the claimed 877,000 records remain unverified. Love Electric had been contacted for comment at the time of publication.

“The 999 rows split into 731 primary drivers and 268 additional named drivers. There are exactly 731 distinct quote IDs, and every quote has exactly one primary driver, 731 out of 731. All 268 additional drivers reference a quote that exists in the file, with no orphans.” reads the Ransomnews’s report. “The consent flag governing National Insurance processing is empty for precisely the 268 additional drivers and populated for every one of the 731 primary drivers. National Insurance numbers appear on primary drivers only. Those are constraints enforced by whatever application wrote the data, and they hold across all 999 rows without exception.”

That matters because fabricated breach databases often fall apart when researchers examine the relationships between records. Here, the relationships hold: additional drivers point to existing quotes, the National Insurance processing flag appears where the underlying application logic would expect it, and National Insurance numbers appear only on primary drivers.

Love Electric Financial Services Limited is an Edinburgh-based company that provides EV salary sacrifice administration, credit broking and related services to employers across the UK. Companies House identifies it as an active Scottish company, registered under number SC374952, while Love Electric’s own documentation confirms that it operates as a salary sacrifice administrator and FCA-regulated credit broker.

The business model explains why its systems can contain information that many people would normally associate with payroll departments. Salary sacrifice arrangements require the broker to identify employees, process the scheme and support insurance and tax-related requirements, so the underlying records can include National Insurance numbers and driving licence information. Love Electric’s privacy policy also says it processes personal information under UK data protection law.

“The seller published a free sample as a 999-row CSV with 24 columns, named in a way that indicates an export of a dbo.drivers table from a Microsoft SQL Server database.” continues the report. “The columns are: id, quote_id, user_id, title, first_name, last_name, email, phone_number, date_of_birth, address, address2, city, country, postcode, national_insurance_number, driving_licence_number, driving_licence_country, allow_processing_national_insurance, primary, created_at, updated_at, deleted_at, weekly_hours and occupation_id.”

The fields included names, email addresses, phone numbers, dates of birth, addresses, postcodes, National Insurance numbers, driving licence numbers, quote IDs and consent-related fields.

The data wasn’t uniformly populated, which is another reason the sample looks like a real production export rather than a synthetic dataset. Around 71% of the rows lacked a name, address or city, 74% had no phone number, and 85% had no National Insurance number, while 147 records contained a National Insurance number and 287 contained a driving licence number.

The geography also made sense. Postcodes clustered around Edinburgh and central Scotland, with records extending into England, while dates of birth ranged from 1946 to 1999 and concentrated around people born in the 1970s and 1980s.

Ransomnews then tested the driving licence numbers against the structure used by UK licences. Of the 108 full-length licence numbers in the sample, 98.1% had a surname block matching the surname in the corresponding record, 97.2% had an initial matching the first name, and 78.7% contained a date-of-birth encoding that matched the stored date of birth.

The imperfections were just as interesting. Licence numbers appeared in many different lengths, only 53% of the National Insurance numbers present matched the expected HMRC format, and phone numbers appeared in three different formats. That kind of mess is exactly what you’d expect from users entering information into a live form, abandoning fields or making mistakes.

“A UK driving licence number is not random. Characters one to five are the holder’s surname padded with the digit 9, characters six to eleven encode the date of birth with 50 added to the month for female holders, and character twelve is the first-name initial. Of the 108 full-length licence numbers in the sample, 98.1% have a surname block matching the record’s own surname field and 97.2% have an initial matching the first-name field. 78.7% carry an encoded date of birth matching the date_of_birth column.” state the researchers. “The roughly one in five that disagree are consistent with people mistyping a sixteen-character string into a web form, which is exactly the error rate real self-reported data carries and synthetic data does not.”

The email addresses provided another useful check. Most belonged to corporate domains associated with identifiable UK employers, Love Electric itself or a European software consultancy, rather than being dominated by Gmail and other consumer providers. That fits the way workplace salary sacrifice schemes operate because employees generally enter through their employer.

The database structure also looked normal. It included a soft-delete field, integer foreign keys for quotes and occupations, regional values for Scotland, England, Wales and Northern Ireland, and even a Jane Doe test record that appears to have survived from the system’s setup. Real databases leave fingerprints like these. Synthetic ones tend to be suspiciously tidy.

The seller’s own history is less convincing than the database evidence. The “seraphims” account was created on July 22, 2026 and had published nine data listings by August 26, roughly two per week, but several of those listings were described by the seller as scrapes rather than breaches.

The Love Electric listing had attracted no replies and only 52 views when Ransomnews checked it. The account’s reputation score of 30 came from a single positive vote posted on August 17 with the comment “keep scrapping”, which says more about the seller’s scraping activity than about a track record of selling verified breach data.

That doesn’t make the Love Electric sample fake. The technical evidence points in the opposite direction. It does mean we should separate two questions: whether the sample appears genuine, and whether the seller really controls 877,000 records.

The second claim is much harder to establish. Ransomnews saw only 0.11% of the alleged dataset, and the sample shows that database rows don’t map directly to individual people. The 999 rows corresponded to 731 quotes and only 58 distinct surname-and-date-of-birth combinations, with one person appearing 48 times.

There’s another clue in the filename. The db2_ prefix suggests that the table may belong to one database among several, so the seller’s 877,000 figure could refer to a larger collection rather than this particular driver table. At this point, treating 877,000 as a confirmed number would go beyond the evidence.

The timeline also deserves caution. The seller claimed an August 2026 attack involving a zero-day in a third-party system, but every sample row carries a created_at timestamp within a six-second window on August 14, 2022. That pattern looks like a bulk migration into a newer platform rather than 999 people signing up within six seconds.

It tells us that the database contains legacy records. It doesn’t tell us when someone took them, how they obtained them or whether the seller’s claimed zero-day played any role.

That last point matters for incident response. “Third-party zero-day” is a claim made by the seller, not an established fact, and attackers have plenty of reasons to make an access story sound more sophisticated than it was. Ransomnews says it has not verified that route.

For the people potentially affected, the more immediate issue is the nature of the exposed information. A password can be replaced. A National Insurance number and a driving licence number can’t simply be rotated because someone has posted them for sale.

That creates an obvious phishing risk. Someone who has a person’s name, date of birth, address, employer and National Insurance number can construct a much more convincing message pretending to be HMRC, a payroll team, an employer or a vehicle leasing provider.

Drivers who used Love Electric should therefore treat unexpected messages about their vehicle scheme, payroll or tax affairs with suspicion. They should verify the sender through a phone number or website they already trust rather than using contact details contained in the message.

Love Electric’s current public material says it works with more than 1,500 companies, which gives some sense of the scale of the service’s employer-facing footprint.

That makes supplier security worth treating as an operational issue rather than a procurement checkbox. If a third-party provider holds National Insurance numbers, driving licence numbers, employment information and contact data, its security controls deserve the same level of scrutiny as any other system handling high-value identity information.

The seller’s alleged third-party entry point is therefore worth investigating, but it shouldn’t become the centre of the story before someone verifies it. The useful evidence is already sitting in the sample: a production-style schema, consistent relationships, realistic user errors and identifiers that line up with real-world records.

The other important detail is the price. $600 for a database containing National Insurance and driving licence numbers isn’t a serious valuation of the data. It’s a price designed to make a quick sale.

And if the seller really has more than the published sample, multiple buyers could obtain the same information. That’s where the risk gets worse: the exposure doesn’t end with the first person who downloads it.

Ransomnews says it did not access or probe Love Electric’s systems, purchase the full dataset, or validate the exposed identifiers against live services. It analysed the free sample, removed identifying information from its publication and notified Love Electric before publication, offering to share the listing and sample with the company’s incident-response team.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, data breach)

US agencies warn Iran-linked actors are targeting internet-exposed water and energy control systems, risking disruption.

Federal agencies updated their cybersecurity advisory this week: Iran-linked actors are inside American water and energy control systems, and they’re not just looking around. They’re changing things.

The updated advisory from CISA, the FBI, NSA, and the Department of Energy says these actors are getting into programmable logic controllers, the small industrial computers that run pumps, valves, and safety alarms. Once inside, they can mess with what operators see on their screens. That’s how you get outages nobody saw coming.

“The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs).” reads the advisory. “These actions disrupted PLCs across several U.S. critical infrastructure sectors through malicious project file interactions and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.”

This isn’t new territory. Back in April, the same agencies flagged Iranian hackers going after Rockwell Automation controllers specifically. The updated advisory widens the net. Now Schneider Electric and Siemens equipment is on the list too.

US agencies have expanded guidance on detecting malicious code changes in PLCs after observing attacks targeting Rockwell Automation, Schneider Electric, Siemens, and other internet-exposed industrial controllers.

Attackers access exposed devices via OT ports (44818, 2222, 102, 502) and modems over SSH (port 22), then exfiltrate PLC project files using vendor tools such as Studio 5000, EcoStruxure Control Expert, and TIA Portal. They modify or delete project logic, including Add-On Instructions (AOIs), manipulate HMI and SCADA displays, and disable shutdown and alarm functions, allowing industrial systems to enter unsafe states without alerting operators.

Organizations should follow vendor security best practices, remove PLCs from direct internet access using secure gateways and firewalls, and monitor logs for indicators of compromise and suspicious traffic on OT ports such as 44818, 2222, 102, and 502. Rockwell users should set controllers to Run mode, while suspected victims should contact vendors and federal agencies.

The agencies say potentially any internet-exposed industrial control system could be a target. Here’s the part that should make plant operators lose some sleep. In one case, the hackers didn’t just peek at a system. They rewrote the controller’s programming logic to disable the processes meant to trigger shutdowns and alarms during dangerous conditions.

“At one U.S. victim, the FBI observed the APT actors download a malicious project file to a targeted PLC using configuration software. Analysis indicated the project file retained ladder logic for downstream function but added logic that overrode specific instruction sets responsible for maintaining safe operating parameters in the victim’s environment.

“Since at least March 2026, the authoring agencies identified (through engagements with victim organizations) an Iranian-affiliated APT group disrupted the function of PLCs.” states the advisory. “Organizations across several U.S. critical infrastructure sectors (including Government Services and Facilities, WWS, and Energy Sectors) deployed these PLCs within a wide variety of industrial automation processes. Some of the victims experienced operational disruption and financial loss.”

Systems could then drift into unsafe territory with nobody watching the warning lights, because the warning lights had been switched off from the inside.

“After the actors extracted device project files, the FBI and CISA identified the modification and deletion of project file logic, to include Add-On Instructions (AOIs) and data manipulation on HMI and SCADA displays [T1565].” continues the advisory.” Additionally, the changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies.”

The advisory ties the activity to the ongoing conflict between Iran and the US and Israel, framing it as an effort to cause disruption inside the United States. It fits a pattern going back to February, when the war started and Iranian-linked hacking picked up sharply across the region.

Not all of it looks like this. Some of it has been standard espionage and embarrassment campaigns, like the leak of FBI Director Kash Patel’s personal email account. Some of it has been genuinely destructive. The Iranian group known as Handala remotely wiped tens of thousands of employee devices at medical device maker Stryker, and separately claimed a breach at California’s Cal Water, saying it could disrupt the water supply. Cal Water pushed back, saying it found no sign anyone had touched its operational networks.

That’s the pattern worth watching: espionage on one track, disruption on another, and now a wider set of manufacturers exposed on the operational technology side. If your PLC talks to the internet, it’s not a bystander anymore.

Nobody wants their water plant’s alarm system to be the one thing an adversary quietly switches off. Time to check who can actually reach those controllers from outside.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Iran-Linked Actors)

A prolific cybercriminal group that calls itself “Scattered LAPSUS$ Hunters” has dominated headlines this year by regularly stealing data from and publicly mass extorting dozens of major corporations. But the tables seem to have turned somewhat for “Rey,” the moniker chosen by the technical operator and public face of the hacker group: Earlier this week, Rey confirmed his real life identity and agreed to an interview after KrebsOnSecurity tracked him down and contacted his father.

Scattered LAPSUS$ Hunters (SLSH) is thought to be an amalgamation of three hacking groups — Scattered Spider, LAPSUS$ and ShinyHunters. Members of these gangs hail from many of the same chat channels on the Com, a mostly English-language cybercriminal community that operates across an ocean of Telegram and Discord servers.

In May 2025, SLSH members launched a social engineering campaign that used voice phishing to trick targets into connecting a malicious app to their organization’s Salesforce portal. The group later launched a data leak portal that threatened to publish the internal data of three dozen companies that allegedly had Salesforce data stolen, including Toyota, FedEx, Disney/Hulu, and UPS.

The new extortion website tied to ShinyHunters, which threatens to publish stolen data unless Salesforce or individual victim companies agree to pay a ransom.

Last week, the SLSH Telegram channel featured an offer to recruit and reward “insiders,” employees at large companies who agree to share internal access to their employer’s network for a share of whatever ransom payment is ultimately paid by the victim company.

SLSH has solicited insider access previously, but their latest call for disgruntled employees started making the rounds on social media at the same time news broke that the cybersecurity firm Crowdstrike had fired an employee for allegedly sharing screenshots of internal systems with the hacker group (Crowdstrike said their systems were never compromised and that it has turned the matter over to law enforcement agencies).

The Telegram server for the Scattered LAPSUS$ Hunters has been attempting to recruit insiders at large companies.

Members of SLSH have traditionally used other ransomware gangs’ encryptors in attacks, including malware from ransomware affiliate programs like ALPHV/BlackCat, Qilin, RansomHub, and DragonForce. But last week, SLSH announced on its Telegram channel the release of their own ransomware-as-a-service operation called ShinySp1d3r.

The individual responsible for releasing the ShinySp1d3r ransomware offering is a core SLSH member who goes by the handle “Rey” and who is currently one of just three administrators of the SLSH Telegram channel. Previously, Rey was an administrator of the data leak website for Hellcat, a ransomware group that surfaced in late 2024 and was involved in attacks on companies including Schneider Electric, Telefonica, and Orange Romania.

A recent, slightly redacted screenshot of the Scattered LAPSUS$ Hunters Telegram channel description, showing Rey as one of three administrators.

Also in 2024, Rey would take over as administrator of the most recent incarnation of BreachForums, an English-language cybercrime forum whose domain names have been seized on multiple occasions by the FBI and/or by international authorities. In April 2025, Rey posted on Twitter/X about another FBI seizure of BreachForums.

On October 5, 2025, the FBI announced it had once again seized the domains associated with BreachForums, which it described as a major criminal marketplace used by ShinyHunters and others to traffic in stolen data and facilitate extortion.

“This takedown removes access to a key hub used by these actors to monetize intrusions, recruit collaborators, and target victims across multiple sectors,” the FBI said.

Incredibly, Rey would make a series of critical operational security mistakes last year that provided multiple avenues to ascertain and confirm his real-life identity and location. Read on to learn how it all unraveled for Rey.

WHO IS REY?

According to the cyber intelligence firm Intel 471, Rey was an active user on various BreachForums reincarnations over the past two years, authoring more than 200 posts between February 2024 and July 2025. Intel 471 says Rey previously used the handle “Hikki-Chan” on BreachForums, where their first post shared data allegedly stolen from the U.S. Centers for Disease Control and Prevention (CDC).

In that February 2024 post about the CDC, Hikki-Chan says they could be reached at the Telegram username @wristmug. In May 2024, @wristmug posted in a Telegram group chat called “Pantifan” a copy of an extortion email they said they received that included their email address and password.

The message that @wristmug cut and pasted appears to have been part of an automated email scam that claims it was sent by a hacker who has compromised your computer and used your webcam to record a video of you while you were watching porn. These missives threaten to release the video to all your contacts unless you pay a Bitcoin ransom, and they typically reference a real password the recipient has used previously.

“Noooooo,” the @wristmug account wrote in mock horror after posting a screenshot of the scam message. “I must be done guys.”

A message posted to Telegram by Rey/@wristmug.

In posting their screenshot, @wristmug redacted the username portion of the email address referenced in the body of the scam message. However, they did not redact their previously-used password, and they left the domain portion of their email address (@proton.me) visible in the screenshot.

O5TDEV

Searching on @wristmug’s rather unique 15-character password in the breach tracking service Spycloud finds it is known to have been used by just one email address: cybero5tdev@proton.me. According to Spycloud, those credentials were exposed at least twice in early 2024 when this user’s device was infected with an infostealer trojan that siphoned all of its stored usernames, passwords and authentication cookies (a finding that was initially revealed in March 2025 by the cyber intelligence firm KELA).

Intel 471 shows the email address cybero5tdev@proton.me belonged to a BreachForums member who went by the username o5tdev. Searching on this nickname in Google brings up at least two website defacement archives showing that a user named o5tdev was previously involved in defacing sites with pro-Palestinian messages. The screenshot below, for example, shows that 05tdev was part of a group called Cyb3r Drag0nz Team.

Rey/o5tdev’s defacement pages. Image: archive.org.

A 2023 report from SentinelOne described Cyb3r Drag0nz Team as a hacktivist group with a history of launching DDoS attacks and cyber defacements as well as engaging in data leak activity.

“Cyb3r Drag0nz Team claims to have leaked data on over a million of Israeli citizens spread across multiple leaks,” SentinelOne reported. “To date, the group has released multiple .RAR archives of purported personal information on citizens across Israel.”

The cyber intelligence firm Flashpoint finds the Telegram user @05tdev was active in 2023 and early 2024, posting in Arabic on anti-Israel channels like “Ghost of Palestine” [full disclosure: Flashpoint is currently an advertiser on this blog].

‘I’M A GINTY’

Flashpoint shows that Rey’s Telegram account (ID7047194296) was particularly active in a cybercrime-focused channel called Jacuzzi, where this user shared several personal details, including that their father was an airline pilot. Rey claimed in 2024 to be 15 years old, and to have family connections to Ireland.

Specifically, Rey mentioned in several Telegram chats that he had Irish heritage, even posting a graphic that shows the prevalence of the surname “Ginty.”

Rey, on Telegram claiming to have association to the surname “Ginty.” Image: Flashpoint.

Spycloud indexed hundreds of credentials stolen from cybero5dev@proton.me, and those details indicate that Rey’s computer is a shared Microsoft Windows device located in Amman, Jordan. The credential data stolen from Rey in early 2024 show there are multiple users of the infected PC, but that all shared the same last name of Khader and an address in Amman, Jordan.

The “autofill” data lifted from Rey’s family PC contains an entry for a 46-year-old Zaid Khader that says his mother’s maiden name was Ginty. The infostealer data also shows Zaid Khader frequently accessed internal websites for employees of Royal Jordanian Airlines.

MEET SAIF

The infostealer data makes clear that Rey’s full name is Saif Al-Din Khader. Having no luck contacting Saif directly, KrebsOnSecurity sent an email to his father Zaid. The message invited the father to respond via email, phone or Signal, explaining that his son appeared to be deeply enmeshed in a serious cybercrime conspiracy.

Less than two hours later, I received a Signal message from Saif, who said his dad suspected the email was a scam and had forwarded it to him.

“I saw your email, unfortunately I don’t think my dad would respond to this because they think its some ‘scam email,'” said Saif, who told me he turns 16 years old next month. “So I decided to talk to you directly.”

Saif explained that he’d already heard from European law enforcement officials, and had been trying to extricate himself from SLSH. When asked why then he was involved in releasing SLSH’s new ShinySp1d3r ransomware-as-a-service offering, Saif said he couldn’t just suddenly quit the group.

“Well I cant just dip like that, I’m trying to clean up everything I’m associated with and move on,” he said.

The former Hellcat ransomware site. Image: Kelacyber.com

He also shared that ShinySp1d3r is just a rehash of Hellcat ransomware, except modified with AI tools. “I gave the source code of Hellcat ransomware out basically.”

Saif claims he reached out on his own recently to the Telegram account for Operation Endgame, the codename for an ongoing law enforcement operation targeting cybercrime services, vendors and their customers.

“I’m already cooperating with law enforcement,” Saif said. “In fact, I have been talking to them since at least June. I have told them nearly everything. I haven’t really done anything like breaching into a corp or extortion related since September.”

Saif suggested that a story about him right now could endanger any further cooperation he may be able to provide. He also said he wasn’t sure if the U.S. or European authorities had been in contact with the Jordanian government about his involvement with the hacking group.

“A story would bring so much unwanted heat and would make things very difficult if I’m going to cooperate,” Saif said. “I’m unsure whats going to happen they said they’re in contact with multiple countries regarding my request but its been like an entire week and I got no updates from them.”

Saif shared a screenshot that indicated he’d contacted Europol authorities late last month. But he couldn’t name any law enforcement officials he said were responding to his inquiries, and KrebsOnSecurity was unable to verify his claims.

“I don’t really care I just want to move on from all this stuff even if its going to be prison time or whatever they gonna say,” Saif said.

British defence firms have reportedly warned staff not to connect their phones to Chinese-made EVs

Mobile phones and desktop computers are longstanding targets for cyber spies – but how vulnerable are electric cars?

On Monday the i newspaper claimed that British defence firms working for the UK government have warned staff against connecting or pairing their phones with Chinese-made electric cars, due to fears that Beijing could extract sensitive data from the devices.