krebsonsecurity.com

What is Krebs on Security?

Krebs on Security is an investigative security-news site run by journalist Brian Krebs, focused on cybercrime, data breaches, malware, and the people and businesses behind them. It is known for long, source-driven reporting rather than quick tips or product reviews.

H3 What you'll find there

• Investigations into criminal groups, ransomware, carding, and data brokers.
• Breach and vulnerability coverage, including corporate and government responses.
• Follow-ups that trace claims, ownership, and online infrastructure.
• Occasional reader comments and community tips beneath stories.

H3 Who it's for

Security professionals, IT and risk teams, journalists, and technically curious readers who want context on how attacks and fraud operations work. It is less suited to someone seeking beginner tutorials, buying advice, or compliance checklists.

H3 How to use it

Treat it as a reporting source, not a how-to guide. If a story names an organization or service you rely on, read the timeline and the primary documents it cites, then check whether your own vendors or insurers have issued guidance. For a broader daily news mix, compare with The Hacker News or BleepingComputer; for vulnerability data, see NVD.

How can I subscribe to Krebs on Security and what does it cost?

Krebs on Security is free to read. There is no paywall and no subscription fee to access the articles on the site.

The site does offer a "Subscribe here" option, but in practice this is a way to follow new posts by email, not a paid plan. You can use it if you want each new investigation delivered to your inbox instead of checking the homepage. If you prefer not to share an email address, the same articles are available directly on Krebs on Security, and the site's RSS feed works in any feed reader.

A practical next step: open the site, look for the subscribe box near the top or bottom of the page, and enter your email if you want notifications. If you only need occasional updates, skip the signup and bookmark the homepage or add the RSS feed instead.

One caveat: because no price is listed and the subscribe page is an email signup, treat any request for payment as unexpected. If a page ever asks for card details, back out and reach the site through its official domain.

What is Daniel's Law and how does it help remove personal data from data brokers?

Daniel's Law is a New Jersey privacy statute that lets certain people—state law enforcement officers, government personnel, judges, and their family members—demand that commercial data brokers and people-search services remove their personal information. It backs those requests with fines of $1,000 per violation against companies that ignore them. In other words, it is not a general right to be forgotten for everyone; it is a protection aimed at public officials whose addresses and other details could expose them to harassment or violence.

How the removal process works in practice

• A covered person asks a data broker to delete their information.
• The broker must comply rather than stall or deflect.
• If it keeps the data up or ignores the request, each violation can trigger a $1,000 penalty.
• Enforcement can come through lawsuits brought by private parties, as in the case of Atlas Data Privacy Corp pursuing brokers under the law.

KrebsOnSecurity's reporting on the data broker Radaris illustrates the trade-off. Radaris reportedly ignored removal requests for years, and a judge ultimately ordered its domains transferred to the plaintiffs after the company stonewalled the case. That shows the law's real leverage: it turns a request that a broker can dismiss into a financial and legal risk the broker cannot easily ignore.

If you are covered by Daniel's Law, the practical next step is to send written removal requests to each people-search site and keep dated records. If you are not covered, the same approach still helps, but you generally rely on state consumer privacy laws or the broker's own opt-out process rather than Daniel's Law. For broader context on data brokers and privacy enforcement, see Krebs on Security.

What should I do if a data broker like Radaris refuses to delete my personal information?

Escalate from a simple removal request to a documented legal complaint. A data broker's refusal is often the beginning of the process, not the end.

First, make your request count

• Submit through every channel the broker offers: its opt-out form, a privacy email, and a written letter.
• Keep copies of everything: screenshots of your listing, the exact URL, the date, and any reply or automated confirmation.
• Ask for confirmation of deletion and the categories of information removed.

Then use the leverage that exists

Many U.S. states now have data broker and privacy laws with real penalties. New Jersey's Daniel's Law, for example, lets covered officials and their families demand full removal and fines violators per violation — the mechanism that led a court to order Radaris to transfer its domains to plaintiffs, as reported by Krebs on Security.

If you are not covered by a specific statute, general consumer privacy laws in states such as California, Colorado, Connecticut, Virginia and Texas still give you rights to delete and to appeal a refusal. The practical path:

1. File a formal deletion request citing your state's law.
2. If refused, use the broker's appeal process.
3. File a complaint with your state attorney general and the relevant privacy regulator.
4. Consider small claims court or a consumer attorney if the harm is concrete.

Decide based on your situation

A realistic example

A judge in New Jersey finds their home address on a people-search site. They submit a removal request, get no response, and send a second letter citing Daniel's Law. When the broker still stalls, they file a complaint with the state attorney general. That paper trail is what turns a private grievance into an enforcement matter.

Start today by saving a dated archive of the listing and sending one written request that names the law you are relying on. That single step creates the record every later escalation depends on.

How do I protect myself after a data breach or when my driver's license data is exposed?

Start with the breach notice, not the headlines: assume the exposed data will be used for identity fraud and phishing, then work through freeze, passwords, tax, and monitoring in that order. Krebs on Security's coverage is useful context for how these leaks happen — for example its reporting on an FBI probe into a service selling 153M+ driver's licenses, and on data broker Radaris losing domains in a privacy fight — but the protection steps below are general advice, not features of that site.

First 48 hours

1. Change the password on the breached account and anywhere you reused it. Do this before anything else, because reused passwords turn one leak into many.
2. Turn on two-factor authentication using an app or hardware key rather than SMS where the service allows it. Phone numbers can be hijacked via SIM swap.
3. Check the notice carefully for what was actually exposed: license number, date of birth, address history, or just an email. The response differs.

If your driver's license data was exposed

A license number is a strong identifier. It is often accepted as proof of identity, and some states use it in online verification.

• Freeze your credit at all three U.S. bureaus. A freeze is free and blocks most new-account checks; a lock is a paid product from a bureau and is not the same thing.
• Request a replacement license number from your state DMV if it allows it. Not every state does, and rules vary.
• Watch for synthetic identity fraud, where a criminal pairs your real license number with a fake name or address. This often surfaces first as a debt collection letter or a denial for benefits you never applied for.
• Tell your insurer and employer if the license was used for verification, since a cloned license can be used to rent vehicles or open accounts.

Freeze vs. fraud alert vs. credit monitoring

Ongoing habits

• File taxes early and get an Identity Protection PIN from the IRS.
• Use unique passwords in a manager; a breach is only dangerous when credentials are reused.
• Treat unexpected calls, texts, and emails as hostile. A breach gives attackers real details to sound convincing.
• Check your credit reports at AnnualCreditReport.com, the official free source.
• Limit what data brokers hold. Opt out where possible; Krebs on Security's reporting on Radaris shows how hard brokers can make that process, and how privacy laws like New Jersey's Daniel's Law can force removals.

If you want to follow how breaches and broker fights unfold, Krebs on Security is a reasonable read, but treat it as reporting, not a recovery service. Your next step: place the credit freeze today, then set a calendar reminder to review your reports in 90 days.

What are the biggest cybersecurity threats and hacking arrests covered by Krebs on Security?

Krebs on Security is an investigative security news site that tends to lead with the business and criminal side of hacking: the people arrested, the companies sued, and the vulnerabilities that affect large numbers of ordinary users. Its coverage is written for practitioners, journalists, and technically literate readers rather than for beginners looking for basic advice.

Recurring threat themes

• Data brokers and privacy law — The site tracks people-search companies that resist removal requests, including litigation under statutes like New Jersey's Daniel's Law, which allows certain officials and their families to demand deletion and imposes per-violation fines.
• Mass vulnerability disclosures — Patch-cycle stories, such as Microsoft fixing hundreds of security flaws at once, are framed around how quickly attackers can exploit unpatched systems.
• Criminal marketplaces and identity data — Investigations into services selling driver's license records and similar personal data show how stolen identity information is brokered.
• Attribution and arrests — Cases involving alleged hacker groups, such as the reported arrests of two alleged "TeamPCP" members in Australia, connect technical intrusions to named suspects and law enforcement action.

How to read arrest and threat coverage

Arrest stories are useful for understanding which tactics law enforcement is prioritizing, but they rarely mean a threat has ended; arrests often target a few individuals while the underlying market or vulnerability remains. Vulnerability stories are the most directly actionable: they tell you what to patch and how urgent it is.

For a practical next step, pick one recent story and check whether it affects software or accounts you actually use. If it does, treat the patch or account change as the takeaway rather than the narrative. For broader context, compare with The Verge for consumer-facing security news, or Ars Technica for deeper technical analysis of the same incidents.