The Leak of 153 Million US Driver's Licenses — a National Security Threat

The scale of the breach

As reported by Brian Krebs (Krebs on Security), a new service called Nexus has surfaced on the dark web, offering access to identity documents: 3 million travel documents and 153 million driver's licenses belonging to US and Canadian citizens. According to Tom Uren, the author of the Lawfare article, the US portion of the database accounts for roughly 63% of all driver's licenses in the country.

The operators of Nexus claim they gained unauthorized access to a major identity-verification company and, for over a year, “continuously” siphoned off new data into a private database. Krebs noted that in a single day the number of licenses in the database grew by nearly 400,000 — meaning data was being added on a regular basis.

Krebs confirmed the documents were genuine: alongside his own license, he found the licenses of nine of his relatives and acquaintances, as well as those of sitting officials — including Secretary of Defense Pete Hegseth and one of the FBI's deputy directors. Based on a combination of circumstantial clues, he tied the incident to the identity-verification service IDScan. The FBI is investigating, and IDScan has confirmed the breach. Nexus itself soon vanished from the dark web, though the hackers made no claim of having deleted the data — most likely they simply went to ground.

Why this is an intelligence problem

A driver's license is a key identity document, and license numbers often appear in other databases. Once records can be tied to a specific person — with a home address and a photograph — the value of any other stolen or purchased database rises sharply.

Uren points out that the threat is not hypothetical. In the mid-2010s, Chinese cyberspies stole complementary datasets from Anthem, Equifax, Marriott, United Airlines and — most importantly — security-clearance records from the Office of Personnel Management (OPM). US intelligence is confident this data was used against its operations in China.

The author also cites the investigators at Bellingcat: leaked databases helped them unmask a deeply undercover GRU agent who had tried to infiltrate a NATO command post in Naples, and earlier to identify the suspects in the “Novichok” poisoning of Sergei Skripal. If a small research group can piece together leaked Russian data, Uren reasons, then Chinese intelligence services are surely doing the same with American data.

A systemic vulnerability

Breaches at identity-verification services happen with depressing frequency: over the past two years, AU10TIX, Discord's age-verification provider (5CA) and National Public Data have all been hit. Such services are needed to fight fraud, but the sheer volume of sensitive data they hold turns them into a point of vulnerability in their own right — and, in the author's view, they ought to be subject to strict regulation and oversight.

Uren does not expect swift measures from the authorities. In the short term, the hope is that serious financial consequences will push companies to shore up their defenses: lawyers are already preparing class-action suits against IDScan, and some attention from the Federal Trade Commission wouldn't hurt either.

Source: Hacker News