A dark-web service called Nexus advertised scans of more than 153 million U.S. and Canadian driver’s licenses, including those of senior government officials. The trail points to a widely used identity verification company. Identity verification provider IDScan.net has since confirmed that hackers accessed customer data in its cloud platform.
A sample license, then an FBI inquiry
Security journalist Brian Krebs broke the story on Sept. 1, after a source flagged a new seller on the Russian cybercrime forum Exploit. The seller had offered Krebs’s own Virginia license as a free sample. Nexus claimed more than 153 million driver’s licenses, more than 10 million ID cards, more than 3 million travel documents and at least 579,000 medical cards. Its driver’s license count grew by nearly 400,000 in 24 hours. “We have been continuously exfiltrating new data for over a year into our private database,” the sellers wrote. Records for sale included the license of Defense Secretary Pete Hegseth and that of an FBI assistant director.
Each record Krebs examined held up to six images: the front and back of the license, a basic scan, and infrared and ultraviolet versions. Each was timestamped. Nine friends and relatives whose licenses turned up confirmed the timestamps matched trips. Several matched Hertz car rentals, and researcher Zach Edwards’s matched a visit to a Planet13 cannabis dispensary. Both Hertz and Planet13 use IDScan.net. The company says it processes more than 21 million verifications a month, and its technology scans IDs with infrared and ultraviolet light. The FBI’s New Orleans field office opened an investigation.
IDScan confirms
In a Sept. 4 security notice, IDScan said it learned on or around Sept. 1 that an unauthorized third party “may” have accessed or copied customer information stored in accounts on its cloud, BleepingComputer reported. That information can include full names and license or other government ID numbers. The notice was set to keep search engines from indexing it. Lawsuits have already been filed. IDScan is offering free credit monitoring and says it is cooperating with federal law enforcement. Nexus went offline after the reports, but the criminals likely still have the data, and several actors have claimed to be selling the full database.
Why the scale matters
Licenses are a standard proof of identity for opening credit, and the infrared and ultraviolet images could help forgers. Larry Baldwin, principal intelligence researcher at Cybera, whose own license was in Nexus, warned that the data could expose people who don’t want to be found, including domestic violence survivors and people in witness protection. “Just when it seems like we’re making some headway in improving authentication controls through drivers license verification systems, this happens,” he said.
Edwards said companies that collect ID scans need to be held to a higher standard. “These systems are putting sensitive data into more and more 3rd party vendors, and we don’t have nearly the oversight to ensure they are safe,” he told Krebs. Security teams should treat license scans as high-risk data. That means asking verification vendors how long they keep images and where, and not relying on a license image alone to verify identity.
WebProNews is an iEntry Publication