A data breach allegedly affecting Love Electric, a UK-based electric vehicle salary sacrifice scheme provider, has led to a threat actor offering 877,000 driver records for sale on an English-language data-breach forum. The seller, identified as "seraphims," posted the listing on August 26, offering the dataset for $600 in cryptocurrency, with the price negotiable.
While the total number of records claimed by the seller remains unverified, a sample of 999 rows published with the listing has been examined by researchers, who found strong indications that the data originated from a genuine production database. Love Electric has been contacted for comment regarding the alleged breach.
The 999-row sample, provided as a CSV file with 24 columns, appears to be an export of a `dbo.drivers` table from a Microsoft SQL Server database. The columns include `id`, `quote_id`, `user_id`, `title`, `first_name`, `last_name`, `email`, `phone_number`, `date_of_birth`, `address`, `address2`, `city`, `country`, `postcode`, `national_insurance_number`, `driving_licence_number`, `driving_licence_country`, `allow_processing_national_insurance`, `primary`, `created_at`, `updated_at`, `deleted_at`, `weekly_hours`, and `occupation_id`.
The exposed fields contain sensitive personal information such as names, email addresses, phone numbers, dates of birth, addresses, postcodes, National Insurance numbers, and driving licence numbers. The data also includes quote IDs and consent-related flags.
Analysis of the sample revealed that the data was not uniformly populated, which is consistent with real-world production data rather than synthetic datasets. For instance, approximately 71% of the rows lacked a name, address, or city, 74% had no phone number, and 85% had no National Insurance number. However, 147 records did contain a National Insurance number, and 287 included a driving licence number.
The geographical distribution of postcodes in the sample clustered around Edinburgh and central Scotland, extending into England, aligning with Love Electric's operations. Dates of birth ranged from 1946 to 1999, with a concentration among individuals born in the 1970s and 1980s.
Further validation involved testing the driving licence numbers against the structure of UK licences. Of the 108 full-length licence numbers in the sample, 98.1% had a surname block matching the surname in the corresponding record, 97.2% had an initial matching the first name, and 78.7% contained a date-of-birth encoding that matched the stored date of birth. The imperfections, such as varying licence number lengths and inconsistencies in National Insurance and phone number formats, were also noted as indicative of real user input.
The relationships between records in the sample also held up under scrutiny. The 999 rows comprised 731 primary drivers and 268 additional named drivers. There were exactly 731 distinct quote IDs, each linked to one primary driver. All 268 additional drivers referenced an existing quote within the file. The consent flag for National Insurance processing was empty for the additional drivers and populated for all primary drivers, with National Insurance numbers appearing only for primary drivers. These internal consistencies suggest the data's authenticity.
Love Electric Financial Services Limited, registered in Edinburgh under number SC374952, operates as an active Scottish company. Its business model as a salary sacrifice administrator and FCA-regulated credit broker necessitates the collection of information typically associated with payroll departments, including National Insurance numbers and driving licence details, to process schemes and manage insurance and tax requirements. The company's privacy policy states it processes personal information under UK data protection law.
