153 Million Driver's License Records for Sale on Dark Web

US digital identity-verification provider IDScan.net has acknowledged that an unauthorized party may have viewed or copied customer data stored in its cloud. Shortly beforehand, the operators of a dark web service said they were offering scans of more than 153 million driver's licenses from the US and Canada, along with millions of other identity documents. In the US, driver's licenses are also widely used as government-issued photo identification.

The records appear to have originated in identity checks at businesses such as age-restricted retailers and car rental companies, where customers presented their IDs for scanning and authentication using IDScan.net systems.

Security journalist Brian Krebs examined numerous documents from the dark web service Nexus and found several clues pointing to IDScan.net. The FBI's New Orleans field office opened an investigation on 1 September. The records Krebs reviewed included the driver's license of US Defense Secretary Pete Hegseth and that of a senior FBI official. Shortly after Krebs published his report, Nexus disappeared from the dark web.

You might be interested Romania's Land Registry Goes Dark After Cyberattack

Nexus was advertised in late August on the Russian-language cybercrime forum Exploit. Its operators claimed to possess more than 153 million driver's license records, as well as more than 10 million other identity cards, three million travel and international identity documents and at least 579,000 documents described as “medical cards”.

A search on Nexus with the search field left blank returned about 11.5 million pages of results, each containing around 15 entries. This supports the claimed scale but does not establish either the exact number of records or that each belongs to a different person.

Six Images of a Single Driver's License

Krebs found his own driver’s license in the database. The record contained six images: the front and back, each captured in visible, infrared and ultraviolet light. These additional images reveal security features that are invisible or difficult to see in ordinary photographs and are used to authenticate identity documents.

With their consent, Krebs also searched for documents belonging to friends and relatives. In nine cases, the stored timestamps corresponded to trips or other occasions when they had presented their driver's licenses.

The clearest link emerged from a car rental involving Krebs and his mother. They handed over their driver's licenses to Hertz at the same time. On Nexus, images of their documents were timestamped only seconds apart.

Timestamps for other individuals also pointed to Hertz. In the case of another person, the timestamp corresponded to a visit to the Planet13 cannabis dispensary in Las Vegas.

IDScan.net announced a 2022 identity-verification agreement with Planet13 and has listed Hertz among its customers. Its systems scan and authenticate government-issued identity documents. According to IDScan.net, its technology handles more than 21 million identity verifications a month at over 20,000 locations worldwide.

IDScan.net Acknowledges Possible Unauthorized Access

On 4 September, IDScan.net said an unauthorized third party may have accessed or copied customer data held in its cloud. The potentially exposed information may include full names and driver's license or other government-issued identification numbers.

IDScan.net is still investigating which individuals and what data are involved. Anyone potentially affected will be offered free credit monitoring and identity-protection services. The company says there is currently no evidence that the unauthorized access is continuing. Records uploaded before 1 September may be affected.

https://twitter.com/NewsTongueX/status/2095281068383383630

IDScan.net has not confirmed Nexus's claim of more than 153 million driver's license records or that the entire trove came from its systems. It also remains unclear how the attackers gained access. Nexus's operators said they had been continuously exfiltrating new data for more than a year, an assertion that has not been independently verified.

First Lawsuits Filed

For those affected, the release of such data poses a lasting risk. A password can be changed. A name, date of birth, facial image and other information contained in a government-issued ID cannot simply be replaced. Once an ID scan has circulated, it can remain useful to criminals for years.

The IDScan.net logo displayed on a smartphone screen. Photo illustration: Thomas Fuller/SOPA Images/LightRocket via Getty Images

Such records can facilitate identity fraud and the circumvention of identity checks, especially when combined with other stolen personal data. Criminals could, for example, try to open credit, bank or mobile phone accounts in a victim's name or impersonate that person when dealing with companies.

An ID scan alone, however, is not sufficient for every verification process. Many services require additional personal information or biometric checks.

Since 2 September, several lawsuits have been filed against IDScan.net in the US District Court for the Eastern District of Louisiana, a federal trial court. The plaintiffs allege, among other things, that the company failed to meet its obligations in handling their data.

No final findings are yet available on the scope or cause of the incident or the precise number of people affected.