Authenticator for X, TikTok Exposes Personal User Info for 18 Months

**Executive summary:** AU10TIX, an identity-verification provider used by major apps (including X, TikTok, LinkedIn, Coinbase, PayPal and others), had employee credentials exposed that granted access to a logging platform containing names, birth dates, nationalities, ID document images, and proprietary verification data; those credentials appear to have been stolen by malware in December 2022 and posted to Telegram in March 2023, with the exposed system remaining online for about 18 months and potentially exposing large volumes of sensitive PII.