Iranian Insurance DB For Sale

A dark-web seller is advertising what it says is a 500-megabyte Iranian database with personal, vehicle and insurance records for $15,000. (undercodenews.com) The listing, described by Undercode News as unverified, says the files include names, national identification codes, phone numbers, vehicle registration details, license plates and insurance policy numbers. The report also says the package is structured in formats such as CSV and SQL, which can make records easier to search and sort. (undercodenews.com) Iran’s insurance sector has already faced a larger leak claim. In December 2023, Iran International reported that hackers were selling about 160 million customer records from 23 Iranian insurers for roughly $75,000, and said Leakfa linked the data to a breach at Expert Information Technologists, also known as Fanavaran. (iranintl.com) Bitdefender, citing the same reporting, said the 2023 trove included first names, last names, fathers’ names, national identity numbers, dates of birth, addresses, postal codes and phone numbers. Fanavaran denied a hack, and Iranian authorities also denied that data had leaked, according to Bitdefender and Iran International. (bitdefender.com) (iranintl.com) Insurance data is useful to criminals because it ties identity details to specific cars, policy numbers and coverage dates in one record set. Undercode News said the new listing claims to bundle those fields together, which can support identity fraud, account takeover attempts and targeted scams if the files are genuine. (undercodenews.com) The legal backdrop in Iran is fragmented. DataGuidance says Iran has no general data protection law in force, and DLA Piper says the country has not enacted comprehensive data protection legislation, relying instead on a patchwork of older laws and draft proposals. (dataguidance.com) (dlapiperdataprotection.com) That leaves basic questions unresolved in public reporting: who collected the data, when it was taken, and whether the current seller has fresh records or recycled material from earlier breaches. Undercode News said no independent verification had confirmed the listing and noted the seller carried a negative reputation score on the platform where the data was advertised. (undercodenews.com) Until a victim company, regulator or independent incident-response firm verifies the files, the sale post is still a claim. But the details match the kind of insurance and identity information that has surfaced before in Iran’s market. (undercodenews.com) (iranintl.com)