FBI Probes Service Selling 153M+ Drivers Licenses
FBI Probes Service Selling 153M+ Drivers Licenses
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. The service, dubbed Nexus, claims to have more than 153 million drivers licenses, as well as over 10 million identification cards, more than three million travel documents and/or international IDs, and at least 579,000 medical cards. 🚨
A quick look around Nexus finds they are likely not exaggerating about that 153 million number. It includes documents from people in both Canada and the United States, but the bulk of these records are on Americans: searching for just Canadian drivers licenses returns approximately 1.1 million results, with the largest concentration from Ontario (473,673 records). Curiously, the identity records include not only drivers licenses but also marijuana dispensary cards. 🌿
Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. The people behind Nexus claim the license images are coming from an active breach at “a major identity verification company” whose customers include multiple Fortune 500 companies. “We have been continuously exfiltrating new data for over a year into our private database,” the service enthused in its introductory post on Exploit. Indeed, over the past 24 hours, the number of drivers license records listed as available in Nexus has increased by nearly 400,000, suggesting that freshly stolen license data is being harvested and uploaded to this service on a semi-regular basis. 📈
The record that features my drivers license includes six image files – three pairs of photos of the license’s front and back – a basic image scan – as well as infrared and ultraviolet versions of the same images. Each person whose license could be found (nine of them) confirmed having traveled on or very close to the dates in the timestamps attached to their images.
Here’s where it gets interesting: I was able to find my mother’s drivers license in this service as well, and the timestamps for her images are just a few seconds apart from mine. That’s notable because we both handed our licenses to the Hertz rental car representative at the same time. Zach Edwards is a well-known security and privacy researcher. A scan of Edwards’s drivers license is available for purchase on this identity theft service, and Edwards said the timestamp on his record corresponds to the middle of a trip last month to Las Vegas for the annual DEFCON security conference. 🎤
Edwards said the dispensary he visited that day was Planet13, a multi-state chain with stores in California, Florida, Illinois, and Nevada. In 2022, the New Orleans-based identity provider idscan.net published a press release announcing an exclusive identity verification agreement with Planet13’s dispensaries nationally. And as idscan.net’s own documentation states, the technology scans IDs with both infrared and ultraviolet light.
Contacted by KrebsOnSecurity, idscan.net said it was investigating the matter. The New Orleans field office of the Federal Bureau of Investigation (FBI) today launched an official inquiry into the source of the images. During that call, the FBI shared that earlier today their New Orleans field office opened an official investigation into an apparent breach involving idscan.net.