stolen driver's licenses and equifaxAs information gleaned from the investigation into its data breach is analyzed, Equifax has continued to release more details on exactly who and what were compromised when hackers ran loose for four months in the credit bureau’s computer systems. To keep you up to date with the latest developments, we’ve got the lowdown on a recent malware scare with the Equifax website this past week, as well as newly released numbers for U.S. driver’s licenses and U.K. citizens exposed in the breach. Keep reading to learn about these developments.

Parts of Equifax’s website were briefly compromised this week

On Oct. 11, an independent security analyst attempted to check his credit report on the main Equifax website — not through TrustedID Premier — and was surprised when his browser redirected him to a page that prompted he download a fraudulent Adobe Flash update. If clicked to download, the page would have infected his computer with adware. Some experimentation by the researcher led to him encountering the redirected page three more times. An Ars Technica reader noted that they experienced something similar around the same time when viewing the site through a mobile device, except this time they were redirected to an iPhone X contest promo. This type of attack, known as a drive-by download attack, is used by attackers who want to stay under the radar. Only a certain number of visitors are shown the false page, and it (usually) only happens once. Though somewhat different, this technique is similar to malvertising, and its presence on the Equifax website so soon after the announcement of a major data breach is infuriating and exasperating in equal measure.

This unusual behavior was noted on Oct. 11 as well as for a few hours during the morning of Oct. 12, after which Equifax disabled the page in question. When questioned, Equifax stated that its systems had not been compromised — instead, a third-party vendor which was running code on the Equifax website was compromised, causing malicious content to be served to Equifax visitors. This third-party vendor is reportedly used to collect website data for Equifax. The credit bureau said it has removed the part of its site that was experiencing issues, and hopefully this will be the last anyone will see of this type of issue on its site. This instance is just one more blemish on the credit bureau’s already battered and bruised reputation.

10.9 million driver’s licenses were compromised in the breach

Sources close to the situation revealed to Wall Street Journal reporters that approximately 10.9 million driver’s licenses were compromised in the data breach. It was disclosed when the story broke back in September that driver’s licenses were among the stolen data, but this is the first indication of how many driver’s licenses were involved exactly. It’s likely that these were provided to Equifax by consumers who used its online credit reporting dispute page, as a form of identity verification. If you’ll remember from earlier posts on the breach, it’s been said that the hackers accessed Equifax’s databases via the dispute page. Though the data on a driver’s license varies from state to state, it can be used by thieves for a number of fraudulent purposes, such as creating fake IDs to commit identity theft in your name. Combined with other information exposed in this breach, such as social security numbers, any criminal with access has the potential to cause a lot of trouble for a lot of people in a whole bunch of ways.

Official data on U.K. residents exposed has been released

This massive data breach didn’t just affect Americans — some Canadian and U.K. citizens also had their information compromised. Equifax’s public update on the finalization of the investigation into the breach on Oct. 2 revealed that approximately 8,000 Canadian citizens were impacted. However, it didn’t divulge any specifics about U.K. citizen exposure, except to acknowledge that there had been some. Now, Equifax has said that a file containing 15.2 million U.K. consumer records was involved in the data breach — while some of it contained information which could put those consumers at risk, the majority of the records (14.5 million) were either false or merely contained the name and birth date of a U.K. citizen. The number of consumers at real risk is closer to 694,000 — up from the original estimate of 400,000 — and Equifax will be notifying each of those individuals by mail. It’s uncertain what, if any, assistance will be offered to non-U.S. citizens who were compromised — the free TrustedID Premier service Equifax has offered is only available to people with a valid social security number.

To learn more about this and other breaches, follow our data breach alerts blog. We’ve also got plenty of tips on protecting your information on our identity theft protection blog.