{"schema_version":"1.0","service":"Publicasta","type":"article","id":482,"slug":"nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03","title":"Nexus 身份扫描事件说明：证件验证本身已成为网络安全风险","excerpt":"据报道出售的驾照和身份证扫描件，不只是普通泄露，而是暴露了保存身份凭证的隐藏风险。","language":"zh","default_language":"en","canonical_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=zh","image":{"url":"https://publicasta.com/storage/projects/9/pages/482/2026/09/e86dd056-e78c-4140-8297-0f7d4397ca19.webp","alt":"匿名证件卡片被盾牌保护，旁边有锁和数据删除图标"},"publisher":{"id":9,"slug":"cybersecurity","name":"Cybersecurity Without Panic","url":"https://publicasta.com/cybersecurity"},"author":{"name":"Anton R"},"published_at":"2026-09-03T13:43:14+00:00","updated_at":"2026-09-03T13:43:14+00:00","content_markdown":"Nexus 事件不是又一次密码泄露。它涉及的是人们用来证明身份的材料：驾照、身份证、旅行证件、医疗卡、面部照片、条码、签名和证件防伪特征。KrebsOnSecurity 报道称，一个新的犯罪服务出售美国和加拿大超过 1.53 亿份驾照扫描件，以及数百万其他身份文件。报道称 FBI 新奥尔良办公室已展开 inquiry，Nexus 网站随后消失。\n\n ![匿名证件卡片被盾牌保护，旁边有锁和数据删除图标](https://publicasta.com/storage/projects/9/pages/482/2026/09/e86dd056-e78c-4140-8297-0f7d4397ca19.webp)\n\n 正确反应不是恐慌，而是区分已知事实、观察和指控。证件扫描件不像密码。密码可以更换，但脸、生日、签名、旧地址和证件照片的副本很难真正撤回。\n\n ## 已知情况\n\n Krebs 报道的数字包括超过 1.53 亿份驾照、1000 多万份身份证件、300 多万份旅行或国际证件，以及至少 57.9 万份医疗卡。他还描述空白搜索会返回约 1150 万页结果。这些应被视为报道中的观察和声称数量，而不是最终取证总数。\n\n Krebs 找到了自己的驾照记录，并描述其中包含正反面图像，包括普通、红外和紫外版本。部分亲友记录的时间戳与旅行或租车时间接近。这说明风险可能来自日常身份验证场景，而不是少数极端案例。\n\n ## 尚未证明什么\n\n 具体来源还没有公开完成取证确认。受影响的唯一人数、重复记录、数据年代和是否持续泄露都不明确。IDScan.net 被 Krebs 指向为可能来源，但在可用报道中，公司尚未确认未经授权访问的性质和范围。\n\n 也不能因为营销页面出现某个客户名称，就认定该公司客户受影响。Krebs 更新中提到 Caesars 表示自己不是 IDScan.net 客户，并且自 2025 年 2 月起不再使用 VeriScan。\n\n ## 为什么证件扫描更危险\n\n 扫描件把姓名、生日、地址、证件号、签名、照片、机器可读数据和防伪特征放在一起。它可用于社工、账户恢复、欺诈申请、人肉搜索、骚扰或薄弱身份检查。\n\n 更换驾照可能有帮助，但不是完全重置。旧图片仍包含面部、签名和历史地址。医疗卡和旅行证件还可能暴露健康、国籍、行程和人身安全风险。\n\n ## 这些副本如何产生\n\n 用户以为自己只是在租车、住酒店、进入场所、购买受年龄限制商品或做在线年龄验证。后台可能读取条码、拍摄正反面、采集红外或紫外图像、做人脸匹配、调用 API、保存验证结果，或者保存完整图像。\n\n 从隐私角度看，这些完全不同。更安全的设计只证明最少事实：年龄足够、证件看起来有效、今天已完成检查。更危险的设计则为了一个是/否结果保存完整证件多年。\n\n ## 为什么验证供应商会成为系统性风险\n\n 身份验证供应商确实有价值：假证存在，受监管行业也有义务。但一个 API 如果连接租车、酒店、门禁、金融、零售和物流，就会集中大量高价值证件资料。最终用户通常不能选择供应商，也看不到保留政策。\n\n 因此，一个为客户降低欺诈的服务，如果保存太多完整证件，也可能增加社会总体风险。准确识别假证不够，数据最小化、加密、访问日志、短保留期、可验证删除和清晰合同同样重要。\n\n ## 个人可以做什么\n\n 不要去犯罪市场或“泄露查询”网站找自己，也不要上传更多证件。等待曾扫描你证件的机构发出正式通知。对声称更换证件、酒店、租车、退款或年龄验证的紧急邮件和电话保持怀疑。\n\n 在美国，可以考虑对 Experian、Equifax 和 TransUnion 设置信用冻结。它不能阻止所有滥用，但会让开设新信用账户更难。已经出现滥用时，IdentityTheft.gov 是 FTC 的主要恢复资源。还要加强邮箱、手机号、银行账户、运营商 PIN、交易提醒和抗钓鱼多因素认证。加拿大用户应关注 Canadian Anti-Fraud Centre 和相关机构。\n\n ## 企业应该做什么\n\n 盘点所有扫描 ID 的地方：谁接收图片？是否保存正反面？是否保存红外或紫外版本？保存多久？谁能访问？是否用于模型训练？有哪些分包商？删除能否被审计？\n\n 把验证和保留分开。如果只需要确认年龄，长期保存完整图片很难自圆其说。向供应商索要数据流图、保留周期、事件通知时限、审计报告、存储地区、客户管理密钥、删除 API、访问日志和训练数据规则。\n\n ## 不要做什么\n\n 不要把证件上传到随机查询网站。不要拨打恐吓邮件里的号码。不要在社交平台发布自己的证件截图。不要以为 Nexus 消失就等于数据消失。但也不要绝望：信用冻结、账户监控和强化恢复渠道确实能降低风险。\n\n ## 给普通用户的额外提醒\n\n 如果你最近在租车、酒店、门禁、酒类或其他年龄限制场景中扫描过证件，不需要立刻认定自己已经受害。更好的做法是把它当成长期身份风险：未来几个月更认真查看银行、手机运营商、邮箱恢复通知和信用报告变动。收到所谓“帮你查是否泄露”的网站链接时，反而要更谨慎，因为新的钓鱼活动常常借旧事件吸引受害者再次提交资料。\n\n 对企业来说，也不要等供应商正式承认 incident 才开始盘点。即使这次事件最终范围较小，检查证件扫描、保存、删除和供应商合同仍然有价值。好的安全改进不应该只在确认最坏情况后才发生。最小化保存、清楚删除、限制访问和保留审计日志，本身就是对客户的保护，也能减少下一次事件发生时的法律和信任成本。提前治理比事后道歉便宜得多。\n\n ## 结论\n\n 更安全的方向不是“扫描得更好”，而是“证明得更少”。证明年龄时不交出完整地址，证明访问权限时不保存正反面图像，完成验证时不留下未来可被冒用的材料。Nexus 事件仍在发展，但教训已经清楚：证件副本不是无害的业务残留，而是高价值安全资产。","available_translations":[{"language":"ar","title":"قصة Nexus توضّح لماذا أصبحت عملية التحقق من الوثائق خطراً سيبرانياً","html_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=ar","markdown_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.md?lang=ar","json_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.json?lang=ar","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=ar"},{"language":"de","title":"Der Nexus-Fall zeigt, warum Dokumentprüfung zum Cyberrisiko wird","html_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=de","markdown_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.md?lang=de","json_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.json?lang=de","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=de"},{"language":"en","title":"The Nexus ID-scan story shows why document verification became a cybersecurity risk","html_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=en","markdown_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.md?lang=en","json_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.json?lang=en","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=en"},{"language":"es","title":"La historia de Nexus muestra por qué verificar documentos ya es un riesgo de ciberseguridad","html_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=es","markdown_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.md?lang=es","json_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.json?lang=es","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=es"},{"language":"fr","title":"L’affaire Nexus montre pourquoi la vérification d’identité devient un risque cyber","html_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=fr","markdown_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.md?lang=fr","json_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.json?lang=fr","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=fr"},{"language":"pl","title":"Historia Nexus pokazuje, dlaczego weryfikacja dokumentów stała się ryzykiem cyber","html_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=pl","markdown_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.md?lang=pl","json_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.json?lang=pl","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=pl"},{"language":"ru","title":"История Nexus показывает, почему проверка документов стала киберриском","html_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=ru","markdown_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.md?lang=ru","json_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.json?lang=ru","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=ru"},{"language":"zh","title":"Nexus 身份扫描事件说明：证件验证本身已成为网络安全风险","html_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=zh","markdown_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.md?lang=zh","json_url":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.json?lang=zh","api_url":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=zh"}],"_links":{"self":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.json?lang=zh","api":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=zh","html":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=zh","canonical":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03?lang=zh","markdown":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.md?lang=zh","json":"https://publicasta.com/cybersecurity/nexus_idscan_driver_license_scans_identity_verification_risk_2026_09_03.json?lang=zh","channel":"https://publicasta.com/api/public/v1/channels/cybersecurity","channel_articles":"https://publicasta.com/api/public/v1/channels/cybersecurity/articles","search":"https://publicasta.com/api/public/v1/search","documentation":"https://publicasta.com/api-docs#reading-publicasta","openapi":"https://publicasta.com/api-docs/openapi.json","llms":"https://publicasta.com/llms.txt"}}