On August 22, 2024, ride-sharing and driver recruitment platform Instadriver.co appeared on the leak site operated by the ransomware group Killsec. The listing states that internal files were exfiltrated during a ransomware attack on the company, which helps employers find and hire professional drivers. The number of affected individuals remains unknown, and the leak-site posting does not detail the precise data types contained in the stolen files.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch instadriver.co
Get alerted the next time instadriver.co files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about instadriver.co’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details from the Leak Site
The primary disclosure on the Killsec onion site, archived via ransomware.live, states that Instadriver suffered a ransomware intrusion and that attackers successfully removed internal files. No sample data, exact record count, or ransom demand appears in the public listing. The notification simply marks the victim as compromised and provides a download link for the purported archive, a standard extortion tactic used by this group. Public reporting on Killsec indicates they follow a double-extortion model: encrypt systems where possible and threaten to publish stolen data unless payment is made.
Why This Matters for You and Your Family
If you have ever applied for driving work through Instadriver, your personal information may sit inside the stolen internal files. This could include employment applications, contact details, driver license numbers, insurance records, or background-check information. Even though the exact contents are not public, any exposure of driver-related records creates immediate risk for identity theft, fraudulent job applications in your name, or targeted scams aimed at people who earn a living on the road. Your family members listed as emergency contacts or co-applicants on the same household address are also placed at higher risk.
Doxxing and Identity-Chain Risks
Driver recruitment databases often link real names, phone numbers, email addresses, physical addresses, and sometimes vehicle details. Once attackers possess this information, they can chain it with other breaches to build complete identity profiles. A single leaked phone number can lead to SIM-swapping attempts; an exposed driver license can enable fake ID creation. These chains frequently reach gaming accounts used by children or teenagers in the same household, where usernames, recovery emails, or shared passwords allow attackers to pivot from professional data into personal and social accounts. The result is persistent doxxing that can last months or years.