instadriver.co Listed by killsec Ransomware Group

On August 22, 2024, ride-sharing and driver recruitment platform Instadriver.co appeared on the leak site operated by the ransomware group Killsec. The listing states that internal files were exfiltrated during a ransomware attack on the company, which helps employers find and hire professional drivers. The number of affected individuals remains unknown, and the leak-site posting does not detail the precise data types contained in the stolen files.

Details from the Leak Site

The primary disclosure on the Killsec onion site, archived via ransomware.live, states that Instadriver suffered a ransomware intrusion and that attackers successfully removed internal files. No sample data, exact record count, or ransom demand appears in the public listing. The notification simply marks the victim as compromised and provides a download link for the purported archive, a standard extortion tactic used by this group. Public reporting on Killsec indicates they follow a double-extortion model: encrypt systems where possible and threaten to publish stolen data unless payment is made.

Why This Matters for You and Your Family

If you have ever applied for driving work through Instadriver, your personal information may sit inside the stolen internal files. This could include employment applications, contact details, driver license numbers, insurance records, or background-check information. Even though the exact contents are not public, any exposure of driver-related records creates immediate risk for identity theft, fraudulent job applications in your name, or targeted scams aimed at people who earn a living on the road. Your family members listed as emergency contacts or co-applicants on the same household address are also placed at higher risk.

Doxxing and Identity-Chain Risks

Driver recruitment databases often link real names, phone numbers, email addresses, physical addresses, and sometimes vehicle details. Once attackers possess this information, they can chain it with other breaches to build complete identity profiles. A single leaked phone number can lead to SIM-swapping attempts; an exposed driver license can enable fake ID creation. These chains frequently reach gaming accounts used by children or teenagers in the same household, where usernames, recovery emails, or shared passwords allow attackers to pivot from professional data into personal and social accounts. The result is persistent doxxing that can last months or years.

Killsec’s Known Track Record

Public reporting attributes Killsec’s first notable activity to early 2024. The group has since listed dozens of organizations, focusing on mid-sized companies in logistics, recruitment, and professional services. Their typical playbook begins with initial access through phishing or exploited remote desktop services, followed by lateral movement to exfiltrate documents before deploying ransomware. They maintain their own leak site and rely on public pressure rather than sophisticated negotiation, often publishing victim data within days of an unmet deadline. While not as large as some older ransomware operations, Killsec has demonstrated consistency in following through on leaks when payment is refused.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you ever used on Instadriver.co or related driver portals anywhere it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same address or recovery details.
• Let remediation specialists perform hands-on takedown requests across data brokers and extortion sites on your behalf.

The incident underscores how quickly recruitment and employment data can fuel long-term identity abuse. One breach today can unlock multiple accounts tomorrow unless the connections are deliberately broken. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks. Starting protective measures now limits the damage from both this leak and the ones that will inevitably follow.