As reported by SecurityAffairs, a threat actor operating under the alias "seraphims" has offered a database allegedly containing 877,000 driver records from Love Electric, a UK-based electric vehicle salary sacrifice scheme broker, for approximately $600 in cryptocurrency. The dataset, if authentic, includes National Insurance numbers, driving licence information, and other personally identifiable data on individuals participating in employer-sponsored EV programmes.

Key Takeaway: As reported by SecurityAffairs, a threat actor operating under the alias "seraphims" has offered a database allegedly containing 877,000 driver records from Love Electric, a UK-based electric vehicle salary sacrifice scheme broker, for approximately $600 in cryptocurrency.

Why This Matters Beyond the Headline

The rock-bottom price — under $0.001 per record — is itself a red flag for the broader data economy. When full identity profiles including National Insurance numbers and driving licence data trade at commodity prices, it signals market saturation and low perceived value to the seller. That is deeply concerning. It suggests this category of data is readily obtainable, not rare, and that buyers will likely use it for synthetic identity construction, benefits fraud, or as a stepping stone toward more targeted attacks against higher-value individuals.

The more significant story, however, is the structural risk embedded in the salary sacrifice model itself. Companies like Love Electric sit in a data-sharing chain that many employees never think about: your employer enrols you in a scheme, the scheme administrator processes your National Insurance number, driving licence, and salary details, and insurance underwriters access subsets of that data. Each hop is a potential breach point, and most employees have no idea these third parties exist, let alone that they hold such sensitive information.

The Verification Question

Ransomnews researchers examined a 999-row sample and found strong structural consistency — referential integrity between primary and additional drivers, correct application of consent flags, and National Insurance numbers appearing only where application logic would place them. This is meaningful but not conclusive. Fabricated datasets can be engineered to pass structural checks if the author understands the schema. What would be more convincing is whether the data correlates with known Love Electric customers or employer partner rosters. Defenders should treat this as credible but unconfirmed until Love Electric issues a statement.

The real exposure here is not one company's database — it is an entire sector of financial intermediaries that handle identity-grade data with the security posture of a marketing firm.

Who Is at Risk

The Verification Question
UK employees enrolled in EV salary sacrifice schemes through any broker, not just Love Electric — National Insurance numbers enable tax fraud and synthetic identity construction
Employers who selected these third-party administrators without adequate due diligence on their data security practices
Insurance partners whose underwriting data may have been accessible through the same platform
The FCA-regulated ecosystem — if confirmed, this breach raises questions about whether salary sacrifice administrators should face stricter data protection requirements comparable to payroll processors

Shield53 Recommendations

For Individuals Who May Be Affected

  • Monitor your credit file with UK CRAs (Experian, Equifax, TransUnion) for unfamiliar applications or accounts
  • Be alert to phishing referencing EV schemes, salary sacrifice, or your employer — attackers with breach data can craft highly convincing lures
  • Consider reporting to Action Fraud if you confirm your data was involved, which also creates a paper trail for any subsequent identity theft
  • Check HMRC personal tax accounts for unexplained income or employment records

For Employers Using Third-Party Salary Sacrifice Administrators

  • Conduct an immediate data inventory: what exactly are you sharing with these providers, and is all of it necessary for the service?
  • Request evidence of the vendor's security controls — ISO 27001 certification, penetration test results, data encryption practices, and incident response capabilities
  • Review contracts for breach notification timelines, liability allocation, and data deletion obligations at contract termination
  • Minimise the data passed at enrolment — strip fields that are not strictly required for the scheme to function
  • Inform affected employees proactively if your provider confirms a breach; do not wait for the vendor to communicate directly

For Salary Sacrifice Providers and Similar Intermediaries

  • Audit database access controls immediately — if a single actor can exfiltrate nearly a million records, your segmentation and monitoring are insufficient
  • Implement database activity monitoring with anomaly detection for bulk exports
  • Encrypt National Insurance numbers and driving licence data at rest with field-level encryption, not just disk encryption
  • Engage a third-party incident response retainer now — not after a breach is confirmed

The broader lesson is that data concentration risk in the salary sacrifice sector has been underappreciated. These intermediaries hold identity-grade data on hundreds of thousands of UK workers, yet they operate with far less regulatory scrutiny than the payroll systems that feed them. Until that gap closes, expect more listings like this one.