FBI Probes Sale of 153M Drivers License Scans on Dark Web

The FBI has opened an investigation after hackers began selling digital scans of more than 153 million drivers licenses from people in the US and Canada on a new dark web service called Nexus.

Hackers claim ongoing access to a Louisiana identity verification company. The data was obtained by breaching a major identity verification firm whose customers include multiple Fortune 500 companies. Krebs on Security confirmed the authenticity of the breach after the cybercriminals provided a scan of the outlet's own driver's license, and other victims likewise verified their scans were accurate. The criminals added almost 400,000 new scans within the past 24 hours, supporting their claim of continued access.

The company in question is based in Louisiana and its client list includes Hertz, Target, FedEx, Motorola Solutions, Jack Henry, and Caesars Entertainment. There are indications that at least some of the data was stolen from a verification service used by rental car company Hertz. According to Dexerto, the trove also includes 10 million IDs, 3 million travel documents, and 579,000 medical cards. Malwarebytes reports the seller is IDScan.net, and the company is investigating the breach.

The Nexus service launched this week on the dark web. It was first highlighted by vx-underground and advertised on the Exploit forum on August 31. The service offers front and back scans along with IR and UV images that carry timestamps matching rentals and dispensary visits. Malwarebytes notes that driver's license data is far more valuable than passwords because faces, dates of birth, and addresses cannot be reset.

The New Orleans FBI field office launched an official inquiry today. No public statement has been issued by the agency. The breach raises risks for victims including domestic violence survivors or those in witness protection programs whose photos and addresses could be used to locate them, according to Dexerto. Online scams are estimated to have cost Americans almost $150 billion last year as cyber scams continue to increase dramatically.

The incident highlights the irony and severity of hacking an identity verification service. 9to5Mac observes that this type of breach is depressingly common. The full report from Krebs on Security contains many more details on the breach and the companies involved.