FBI Probes Dark-Web Trade in Scans of 153 Million Driver's Licenses

This week a dark-web identity-theft service called Nexus appeared, trading in digital document scans of more than 170 million North American residents. According to Nexus, the database holds over 153 million driver's licenses of U.S. and Canadian citizens, more than 10 million ID cards, over three million travel and international documents, and at least 579,000 medical records. An empty search query returns roughly 11.5 million pages of results, so the claimed figures appear to be no exaggeration. In the span of a day the number of records grew by almost 400,000: the data seems to be uploaded on a regular basis.

Among the victims are high-ranking officials. The investigation was set in motion by journalist Brian Krebs after a seller posted his own Virginia license as a free sample. That same day the FBI's New Orleans field office opened a formal investigation into the source of the breach.

How the source was traced

Each record contained up to six files — an ordinary scan of the front and back, plus infrared and ultraviolet versions, all with a date and time stamp. With the permission of friends and relatives, Krebs checked their documents: for all nine people he was able to find, the stamps matched the dates of their trips. The initial theory about airports fell apart — there were no passports in the database.

The answer lay in the details. At the airport the journalist himself had shown a passport, and he handed over his license only to a Hertz representative while renting a car — and the stamps on his license and his mother's differed by mere seconds, since both had held out their documents at the same time. Another victim, researcher Zack Edwards, knew for certain that his ID had been scanned by a device only at the Planet13 marijuana dispensary in Las Vegas.

Every trail leads to the New Orleans company idscan.net. Its equipment scans documents in infrared and ultraviolet light, and its clients include Hertz, Target, FedEx, Caesars Entertainment and more than a thousand cannabis dispensaries across 19 states. The company claims more than 21 million verifications per month. idscan.net said it was looking into the matter but has not yet offered a detailed comment.

Why this is dangerous

A driver's license serves as the primary proof of identity when opening lines of credit, so the breach creates a direct threat of fraud. Researcher Larry Baldwin separately points to the risk for those in hiding: victims of domestic violence and participants in witness-protection programs — modern AI-based facial-recognition systems cannot be fooled by a simple change of appearance.

Edwards sees this story as an argument against the widespread demands to present a driver's license in order to access online services “to protect the children”: sensitive data ends up with an ever-growing number of third-party vendors without proper oversight of its security.

Source: Krebs on Security