Security1 distinct publisher2 min readPublished
A forum seller wants $600 for what they say are 877,000 EV salary sacrifice driver records, and the 999-row sample published as proof holds up under structural testing in ways a fabricated file usually does not.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
Fabricated breach databases usually fail on relationships rather than on fields, which is why Ransomnews went at the join columns before anything else [17]. Any generator can emit a plausible name, a postcode and a National Insurance number. Few reproduce the invariants an application enforced on the way in.
The driving licence field carries its own internal check. Of the 108 full-length licence numbers in the sample, Ransomnews reports 98.1% had a surname block matching the surname stored in the same record, 97.2% matched on first initial, and 78.7% encoded a date of birth matching the stored one [15]. That last figure is roughly 85 rows where two separately stored fields agree [1]. Only 108 of the 287 rows carrying a licence number were full length, 37.6% [6].
Sparseness pushes the same way. Around 71% of rows lack a name, address or city, 74% have no phone number, and 85% have no NI number [13]. The 147 NI numbers present reach a fifth of the 731 rows permitted to hold them, 20.1% [5]. Of those 147, only 53% match the HMRC format [16], so about 78 conform and 69 do not [2]. Licence numbers run to several lengths and phone numbers appear in three formats [16]. Synthetic sets are tidier than that.
The distribution fits a Scottish-registered administrator's employer base. Postcodes cluster on Edinburgh and central Scotland with records running into England, and dates of birth span 1946 to 1999, concentrated on people born in the 1970s and 1980s [14].
None of that validates 877,000. The examined sample is 0.114% of the claimed total, one row in 878 [3]. Public: the listing and the CSV. Seller's assertion: everything behind it. Love Electric had not commented when Security Affairs published [4], and Ransomnews itself flags the total as unverified [3].
Price frames the rest. $600 across 877,000 records works out at 0.068 cents each, about 1,461 records per dollar [4]. Nobody paying that audits a row count. The schema is what carries cost downstream: name, date of birth, address, postcode, NI number and licence number in one row [10], held by a salary sacrifice administrator because the scheme requires it to identify employees and support tax and insurance handling [12].
Ranked by verification strength, evidence, and original report placement.
A seller using the name "seraphims" claimed on August 26, on an English-language data-breach forum, to have obtained the driver database of Love Electric, a UK electric-vehicle salary sacrifice broker.
The seller offered 877,000 records for $600 in cryptocurrency, with the price negotiable.
Ransomnews researchers examined the 999-row sample published with the listing and found strong evidence it came from a genuine production database, while the claimed 877,000 records remain unverified.
Love Electric had been contacted for comment at the time of publication.
The 999 rows split into 731 primary drivers and 268 additional named drivers.
There are exactly 731 distinct quote IDs in the sample, and every quote has exactly one primary driver, 731 out of 731.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 28, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
security
Chess.com's 7.3 Million-Record Leak Looks Scraped, And It Dragged Ad Segments Along1 distinct publisher
invest
The FCA finds 44% of young investors think AI financial advice is regulated. It is not.1 distinct publisher
security
Unit 42's Credential Brief: Hunt The Login That Succeeds Right After The Failures1 distinct publisher
product
Callosum raises $100m for mixed-silicon scheduling, and the 2x accuracy claim is still its own2 distinct publishers
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Detailed and checkable, but one chain of custody
The structural work is unusually specific for a breach listing story — 731 quote IDs against 731 primary drivers, 268 additional drivers with no orphan references, 98.1% surname matches inside the licence numbers — and specificity like that is falsifiable, which is why it carries weight. What it does not have is a second reader. Ransomnews opened the file, Security Affairs reported what Ransomnews found, and Love Electric said nothing. Everything downstream of that one analysis inherits its assumptions.
One listing, one sample, no traced consequence
Strip away the analysis and what has actually happened in the world is small: a post appeared on a forum on 26 August with a 999-row taster attached. No sale is reported, no wider redistribution, no fraud tied back to the records, and no notification to the people whose National Insurance and licence numbers are in the file. The exposure may be large; the observed footprint so far is a single advertisement.
Verified sample, advertised total
877,000 is the seller's number. 999 is the verified number — one row in 878, 0.114% of the claim. To its credit, Security Affairs puts that qualification in its second paragraph rather than at the bottom, so the inflation belongs to the listing rather than to the reporting. But the headline still pairs the unchecked total with a price, and a reader who goes no further will remember that 877,000 records were confirmed. They were not; a production-database fingerprint was.
A $600 seller and a leak-desk audience
Follow the motives and they point the same direction. A sample that decodes cleanly is the seller's sales collateral: $600, negotiable, and the proof file exists to make buyers believe the rest. On the other side, the verdict comes from researchers whose subject matter is ransomware and leak listings, published through a security outlet whose readers arrive for exactly this. Nobody in the chain has anything to gain from concluding the file is junk, and the one party with an interest in disputing it — Love Electric — has not spoken.
Confident about origin, not about scale
Two different questions deserve two different answers here. That someone exported real Love Electric driver rows from a live SQL Server table is well supported — the orphan-free quote references and self-consistent licence numbers are hard to fake and easy to check. How many rows exist, when they were taken, whether the hole is closed, and who has to be told: on all of that the record is a single unanswered request for comment.