US and Canadian driver’s license data on the Dark Web: What to know as FBI examines 153 million records | Today’s news
A new identity theft service on the dark web is reportedly offering digital scans of more than 153 million driver’s licenses belonging to people in the United States and Canada, raising serious concerns about identity theft and data security.
The discovery was reported by KrebsOnSecurity, a cybersecurity blog run by Brian Krebs, a former Washington Post reporter with expertise in cybersecurity. The FBI’s New Orleans field office has opened an investigation into the suspected data source, the report said.
What is Nexus?
The service, called Nexus, was advertised on the Russian cybercrime forum Exploit on August 31. Its operators claimed to have the identity documents of more than 170 million people across North America.
According to KrebsOnSecurity, the database contains more than 153 million driver’s licenses, over 10 million identification cards, more than 3 million travel documents or international ID cards, and at least 579,000 medical cards.
The database reportedly includes records from both the US and Canada, although Americans make up the majority. A search for Canadian driver’s licenses alone returned about 1.1 million results, with Ontario accounting for nearly 474,000.
Fresh data is reportedly being added
Nexus claimed the information came from an ongoing breach at a major identity verification company that serves Fortune 500 companies.
The operators claimed that they had continuously acquired data for more than a year. KrebsOnSecurity also noted that the number of driver’s license records increased by nearly 400,000 in just 24 hours, indicating that new data is still being uploaded.
Some records reportedly contained multiple images of the license, including photos of both sides, as well as infrared and ultraviolet scans.
IDScan.net appears as a possible source
Krebs’ investigation pointed to IDScan.net, an identity verification provider based in Louisiana, as a possible source of the leaked information.
The company’s technology scans identification documents using infrared and ultraviolet light. IDScan.net reports that its systems perform more than 21 million identity verifications at more than 20,000 locations worldwide each month.
KrebsOnSecurity found that time stamps attached to several licenses corresponded to occasions when individuals traveled, rented vehicles or visited businesses where their identification was scanned.
Several people whose licenses appeared in Nexus rented vehicles from Hertz around the dates listed in the time stamps.
The FBI is opening an investigation
The FBI’s New Orleans branch has now opened an official investigation into the apparent IDScan.net breach, according to KrebsOnSecurity.
IDScan.net told KrebsOnSecurity that it is investigating the matter, but did not provide substantive answers to specific questions.
Jillian Kossman, the company’s head of marketing and operations, said, “I am not able to share any additional information at this time,” describing the information provided by Krebs as helpful to the company’s investigation.
Why the breach is worrisome
Cybersecurity researchers have warned that scans of stolen driver’s licenses could have serious consequences, as such documents are widely used to verify identities and open financial accounts.
Larry Baldwin, principal intelligence researcher at cybersecurity firm Cybera, said the data could also put vulnerable people at risk, including victims of domestic violence and individuals protected through witness protection programs.
“That’s what’s happening, and the very thing these improvements depend on is at risk,” Baldwin said, referring to efforts to strengthen identity verification through driver’s license verification.
Privacy researcher Zach Edwards similarly warned that increasingly widespread driver’s license requirements are creating large stores of sensitive information at third-party companies without sufficient oversight.
Nexus disappears from the dark web
Shortly after KrebsOnSecurity published its report, the Nexus site reportedly disappeared from the dark web. His login page was replaced with the message: “This service is no longer available.”
However, the disappearance does not prove that the allegedly stolen data has been deleted. The FBI’s investigation into the suspected breach and the source of the identity documents is still ongoing.
Read also | AI cyber risk is biggest immediate threat to global financial system: BoE chief
