Summary

• TuLotero, a Spanish online lottery platform, confirmed unauthorized access to an isolated KYC (Know Your Customer) service between July 13 and July 15, 2026.
• The stolen material was front and back DNI images plus identity verification selfies. TuLotero said passwords, banking data and stored payment methods were not affected.
• Threat actor mor3nako later claimed to sell 37.4 GB and nearly 240,000 KYC images and linked the intrusion to a malware family called TerciosRAT. Both claims are unverified.
• Stolen KYC data lets attackers send context-aware phishing: messages that know the player’s name, ID and gambling platform.
• Gambling operators should monitor for lookalike domains, fake verification portals, fake support accounts and fake apps that use their brand after a KYC incident.

What happened in the TuLotero KYC breach?

An unauthorized party accessed an isolated service TuLotero used for identity verification, which Spanish gaming regulation and anti-money laundering (AML) rules require. The intrusion ran from July 13 to July 15, 2026. TuLotero detected it on July 14 and blocked it the following day.

TuLotero said the compromised material consisted of:

• Images of the front of users’ DNI documents.
• Images of the back of users’ DNI documents.
• Identity verification selfies.

The company reported the incident to Spain’s data protection authority, the Agencia Española de Protección de Datos (AEPD), and to law enforcement on July 17. According to TuLotero information reported by the Spanish consumer organization OCU, about 2% of users were affected, roughly 100,000 people.

What is confirmed and what is only claimed?

The July intrusion into TuLotero’s KYC service is confirmed by the company. The September claims about the size of the stolen dataset and the malware used come from a threat actor and are not independently verified.

The table separates the two:

Threat actors often inflate dataset size, mix data from several breaches or misstate where it came from to attract buyers. The claim still matters operationally: if part of it is genuine, a large set of identity verification images is now on the criminal market.

Why is KYC data more dangerous than a leaked password?

A password can be reset and a payment card can be replaced, but a government ID and a verification selfie cannot be rotated. That makes KYC repositories high-value targets.

A stolen DNI gives an attacker an identity document. A selfie gives visual evidence tied to that identity. Together they can make fraudulent identity verification attempts and impersonation more convincing, especially when combined with data from other breaches. The OCU warned about exactly this risk of identity impersonation.

How do attackers turn a KYC breach into a phishing campaign?

Attackers use the stolen data to make phishing believable, then collect what the breach did not give them: fresh passwords, SMS codes and banking details. The sequence usually looks like this:

1. The attacker already knows the player’s name, DNI, photo and that they use TuLotero.
2. A message arrives: “Your TuLotero account requires identity verification. Complete it to avoid restrictions on your account.”
3. The link leads to a cloned gaming portal on a lookalike domain.
4. The fake portal asks for the DNI, password, SMS verification code, banking details and a new selfie.
5. The attacker now holds working credentials and can take over the account or reuse the identity elsewhere.

This is context-aware phishing. The message is credible because it uses real information from the victim’s relationship with the gaming brand.

How do scammers use fake apps, sign-up flows and support accounts to impersonate betting brands?

Scammers impersonate betting brands with cloned websites, fake mobile apps, fake KYC sign-up flows and fake customer support accounts on social media and messaging apps. Each channel copies a step players already expect, which is why gambling impersonation works.

• Fake verification flows: players are used to uploading a DNI or selfie, so a fake KYC request looks like normal compliance.
• Fake withdrawal notices: “Your withdrawal has been suspended” sounds routine to someone who moves money through a gaming account.
• Fake support agents: players contact support about deposits, bonuses and winnings, so a fake agent on Telegram, WhatsApp or Discord can ask for one-time codes.
• Fake apps and paid ads: copies of the operator’s app, or search ads that send players to a clone site.

PhishFort sees this pressure in its own data. iGaming and Betting accounted for 6.2% of confirmed brand impersonation cases from January to June 2026, and attack velocity in high-risk sectors such as iGaming tripled as AI site builders cut the time from domain registration to live clone to hours (PhishFort internal data).

How do gambling operators remove clone sites and fake KYC portals?

Gambling operators remove clone sites and fake KYC portals by detecting them early and filing takedown requests with the registrar, the hosting provider and, for apps and profiles, the platform. After a KYC incident, monitor these signals:

1. Lookalike domains: new registrations that combine the brand with words like verify, KYC, login, payment or withdrawal.
2. Fake verification portals: pages that request DNI photos, passports, selfies, proof of address, bank details or one-time passwords.
3. Brand impersonation channels: search results, paid ads, social media accounts, Telegram channels, WhatsApp campaigns, Discord communities and malicious mobile apps.
4. Credential harvesting pages: pages that combine brand, login, KYC and payment elements, a strong sign that stolen data is being used.
5. Fake customer support: accounts that offer help with deposits, withdrawals, bonuses or account restrictions.

The goal is to find and remove the infrastructure used to target players, not only to close the original breach.

What should TuLotero players watch for?

Affected players should treat any unexpected identity verification request as suspicious, even when the sender knows their name. Warning signs include requests to:

• Re-upload a DNI or send a selfie through WhatsApp.
• Share an SMS verification code or confirm banking details.
• Unlock an account, verify a withdrawal or pay a fee before receiving winnings.
• Follow a link to an unfamiliar domain.

After a KYC breach, knowing your personal details is not proof that a sender is legitimate. That information may be exactly what the attacker stole.

Timeline of the TuLotero incident

• July 13 to 15, 2026: unauthorized access to TuLotero’s identity verification service, detected July 14 and blocked July 15.
• July 17, 2026: TuLotero reports the incident to the AEPD and law enforcement.
• August 2026: TuLotero confirms about 2% of users were affected and that DNI images and selfies were accessed.
• September 15 to 16, 2026: threat actor mor3nako claims a 37.4 GB dataset of nearly 240,000 images and offers it for sale (unverified).

How PhishFort helps gaming operators after a KYC incident

PhishFort Brand Protection monitors new domains, app stores, social media and paid ads for impersonation of gaming brands, and takes down fake verification portals, clone sites and fake support accounts with registrars, hosts and platforms.

Frequently asked questions

What data was stolen in the TuLotero breach?

TuLotero confirmed that attackers accessed images of the front and back of users’ DNI documents and identity verification selfies. The company said passwords, banking data and stored payment methods were held separately and were not affected.

How many TuLotero users were affected?

About 2% of users, roughly 100,000 people, according to TuLotero information reported by the OCU. A later claim of 37.4 GB and nearly 240,000 images came from a threat actor and is not verified.

Why do criminals target KYC data at gambling platforms?

Regulated gambling platforms must collect government IDs and selfies, so KYC systems hold identity data in one place. That data cannot be changed like a password and makes phishing and impersonation far more convincing.

How do online casinos remove clone and fake KYC sites?

Operators detect lookalike domains and fake portals through continuous monitoring, collect evidence and send takedown requests to the registrar, hosting provider or platform. Many use a brand protection provider to handle detection and takedown at scale.

Sources

• OCU: Filtración de datos en TuLotero
• Cinco Días: TuLotero hack and exposed identity data (August 8, 2026)
• RedesZone: TuLotero confirms DNI and selfie theft
• ADSLZone: TuLotero data allegedly offered for sale
• Escudo Digital: TuLotero KYC database claim
• 20minutos: TuLotero DNI and selfie breach
• Hackmanac threat intelligence on LinkedIn
• PhishFort Digital Threat Intelligence Report, January to June 2026 (PhishFort internal data).

Summary

• Nexus, advertised on the Russian-language cybercrime forum Exploit, claimed documents for more than 170 million people in North America.
• The listing included more than 153 million driver’s licenses, 10 million ID cards, 3 million travel documents and about 579,000 medical cards.
• Some records included front and back images plus infrared (IR) and ultraviolet (UV) scans, the imagery ID verification systems use to validate physical documents.
• Timestamps on stolen images matched ID scans at Hertz rental counters and a Planet13 dispensary, pointing to IDScan.net as the likely source.
• Nexus went offline after the report, but the data is likely to resurface. Organizations that rely on ID documents should expect more convincing fraud and phishing.

What happened in the IDScan.net and Nexus leak?

Nexus, a new identity theft service on the Exploit forum, sold searchable access to identity documents and claimed it had been continuously exfiltrating new data for more than a year. Security journalist Brian Krebs reported that the number of listed licenses grew by nearly 400,000 in 24 hours, which suggests an ongoing compromise rather than a one-time leak.

Krebs began investigating after a source told him his own Virginia driver’s license was being offered as a free sample. By matching image timestamps with the dates and times people had their IDs scanned at Hertz counters and a Planet13 dispensary, he traced the apparent source to IDScan.net, a Louisiana-based identity verification company. TechCrunch also reported that the evidence pointed to a breach of a major ID verification service.

The listing claimed:

• More than 153 million driver’s licenses.

• More than 10 million ID cards.

• More than 3 million travel or international identity documents.

• About 579,000 medical cards.

  

Leaked data breakdown

Shortly after the KrebsOnSecurity report, Nexus replaced its login page with the message “This service is no longer available.”

Who is investigating, and what are the lawsuits about?

The FBI’s New Orleans field office opened an inquiry into the incident. Krebs reported that records of high-ranking US government officials, reportedly including Defense Secretary Pete Hegseth, appeared in the dataset.

Consumers in California, Florida, Georgia and Louisiana filed lawsuits alleging that IDScan.net failed to protect sensitive data and likely violated Federal Trade Commission (FTC) data security guidelines. The plaintiffs seek damages and court-ordered security improvements.

Why are identity verification vendors such attractive targets?

An identity verification vendor processes ID checks for thousands of businesses, so one compromise exposes all their customers. Attackers do not need to breach every rental counter, hotel or dispensary. They only need the shared service behind them.

Partners of ID Scan

ID scanning is now routine in car rentals, hotels, dispensaries, financial services, age-restricted platforms, travel and marketplace onboarding. Each use reduces fraud at the counter but adds to a central store of sensitive data. The more trust and scale a provider accumulates, the more valuable a compromise becomes.

Why is a leaked driver’s license worse than a leaked password?

A password can be reset, but a driver’s license bundles a legal name, date of birth, address, photo, document number and issuing authority that a person cannot easily change. Many organizations still treat it as strong proof of identity.

Replacing the license changes the document number, but the exposed image and personal details can still be abused. That is why the impact of an ID document leak lasts much longer than a credential leak.

What can attackers do with stolen ID scans?

Stolen ID scans give attackers verified personal details they can use to pass weak checks and make impersonation believable:

1. Account opening fraud: submitting stolen document images to open accounts or apply for credit.
2. Account recovery attacks: sending a matching ID image to a support team to take over a victim’s account.
3. Targeted phishing: using real names, addresses and license details to make messages look legitimate, especially when combined with other breach data.
4. Executive and public figure targeting: using exposed IDs of executives and officials for impersonation, doxxing or physical security threats.
5. Bypassing weak KYC (Know Your Customer) checks: reusing images where verification only checks that a document looks valid, without liveness, device or behavior signals.

What should organizations that collect ID documents do now?

Organizations that collect or rely on ID documents should reduce what they store and assume the leaked data will be used against their customers. In order of priority:

1. Review what you collect. If the business only needs a verification result, do not keep the document image.
2. Minimize retention. Set clear retention windows and delete raw images once legal, compliance or fraud review needs end.
3. Reassess vendor exposure. Ask verification providers what they store, for how long, whether they keep raw images, whether they support deletion or tokenized verification, and how they log and monitor access.
4. Strengthen account recovery. Do not accept a government ID alone. Combine known-device checks, recent activity, step-up authentication and manual review for high-risk cases.
5. Monitor for impersonation. Watch for lookalike domains, fake support portals, executive impersonation, fraudulent onboarding attempts, social media impersonation and credential harvesting pages that use breached personal data.
6. Prepare customer guidance. Explain what happened, what data may be at risk and what people can realistically do.

What should individuals do if their ID may be exposed?

People who think their license may be in the dataset should focus on blocking new-account fraud and spotting targeted phishing:

• Place a credit freeze with the major credit bureaus.
• Monitor bank accounts and credit reports.
• Be skeptical of messages that contain accurate personal details.
• Watch for account recovery notices you did not request.
• Use unique passwords and multi-factor authentication (MFA) on important accounts.
• Report suspected identity theft at IdentityTheft.gov in the US or through the Office of the Privacy Commissioner of Canada.

How PhishFort helps after an identity data leak

Leaked identity data makes brand and executive impersonation more convincing. PhishFort Executive Protection detects and removes fake profiles and doxxing that target executives, and PhishFort Dark Web Monitoring watches underground sources for credential and identity data tied to your brand.

Frequently asked questions

Was IDScan.net hacked?

KrebsOnSecurity traced the Nexus data to IDScan.net by matching image timestamps with real ID scans at Hertz and a Planet13 dispensary. The FBI’s New Orleans field office opened an inquiry, and consumer lawsuits allege the company failed to protect the data.

How many driver’s licenses were exposed in the Nexus leak?

Nexus claimed more than 153 million US and Canadian driver’s licenses, plus more than 10 million ID cards, 3 million travel documents and about 579,000 medical cards, covering more than 170 million people.

What can criminals do with a scanned driver’s license?

Criminals can use stolen license scans to open accounts, pass weak KYC checks, take over accounts through support teams and make phishing messages more believable. Executives and officials face added impersonation and physical security risks.

Does getting a new driver’s license protect me?

Only partly. A new license changes the document number, but the leaked image, name, address and date of birth can still be used for fraud, so credit freezes and monitoring remain important.

Sources

• KrebsOnSecurity: FBI probes service selling 153M driver’s licenses
• TechCrunch: It sure looks like hackers breached a major ID card verification service (September 2, 2026)
• USA.gov: Identity theft
• Office of the Privacy Commissioner of Canada: Identity theft guide