New identity theft service on the dark web sells scans of driver's licenses of 153 million people
A new identity theft service launched this week on the dark web is selling digital scans of more than 153 million driver's licenses of people in the United States and Canada. According to interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely used identity verification company based in Louisiana. Additionally, KrebsOnSecurity has learned that the New Orleans office of the Federal Bureau of Investigation (FBI) has launched an official investigation today into the source of the images.The Nexus Service
The service, called Nexus, claims to have more than 153 million driver's licenses for people in the United States and Canada, as well as more than 10 million ID cards, more than three million travel and/or international identity documents, and at least 579,000 medical cards. A quick search on Nexus suggests that the number 153 million is not exaggerated: an empty label on Nexus (without any search parameters entered) returns approximately 11.5 million pages of results, with approximately 15 results displayed per page. The documents include images of people both in Canada and the United States, but most of these records concern Americans: a search for only Canadian driver's licenses returns approximately 1.1 million results, with the largest concentration from Ontario (473,673 records).Data Origin
The people behind Nexus claim that the license images come from an ongoing breach at "a large identity verification company" whose clients include several Fortune 500 companies. "We have continuously exported new data for over a year into our private database," wrote the service owner in his introductory post on the Exploit forum. "Records are available for preview before purchase with the relevant information obscured. Customer photos are displayed if available." Indeed, in the last 24 hours, the number of driver's license records listed as available on Nexus has increased by nearly 400,000, suggesting that stolen driver's license data is being collected and uploaded to this service semi-regularly.Ongoing Investigation
KrebsOnSecurity asked more than a dozen friends and family members for permission to search for their licenses in this service. Every person whose document was found (nine of them) confirmed that they had traveled or were very close to the dates in the timestamps attached to their images. It is clear that the timestamps are set to Greenwich Mean Time (GMT). An initial investigation suggested that the source of the data might be related to airports, but this theory was discarded when it emerged that there are no passports in this data set. Furthermore, only some of those who helped with the search claimed to have shown their driver's license to airport personnel.The Role of IDScan.net
Zach Edwards, a well-known security and privacy researcher, stated that the timestamp on his record corresponds to the middle of a trip last month to Las Vegas for the annual DEFCON security conference. Edwards stated that, although he did not rent a car in Las Vegas, he delivered his license to the TSA checkpoint, at a marijuana dispensary in Las Vegas, and at his hotel (the Aria). Edwards stated that the only one of these three that certainly scanned his document into some kind of device was the dispensary. Edwards visited Planet13, a multi-state chain with stores in California, Florida, Illinois, and Nevada. In 2022, the New Orleans-based identity verification company idscan.net published a press release announcing an exclusive identity verification agreement with Planet13 dispensaries nationwide. IDScan claims to process identity verification for more than 1,000 marijuana dispensaries in 19 U.S. states. The "trust" page of idscan.net states that the company provides identity verification services for numerous large companies, including Hertz, Target, FedEx, Motorola Solutions, financial services giant Jack Henry, and Caesars Entertainment.FBI Investigation
During the course of my research for this story, it appears that the FBI became aware of my work on the apparent source of this new identity theft service. They were probably alerted when I shared with a trusted source that Nexus also sells the driver's license information of the FBI's deputy director (I did not find the FBI director Kash Patel's license on Nexus). Shortly afterward, I was added to a conference call with about half a dozen FBI agents, including senior executives of the agency's cyber division. During that call, the FBI shared that today their New Orleans office has opened an official investigation into an alleged breach involving idscan.net.Impact and Privacy Risks
The discovery of Nexus raises serious concerns about the privacy and security of personal data. Driver's license images, along with other identity documents, can be used for fraudulent purposes, such as opening fake bank accounts, purchasing goods or services in other people's names, or even for more serious criminal activities. The presence of marijuana dispensary cards among the stolen documents adds an additional layer of complexity, as these cards contain sensitive health information and controlled substance use.The Role of IDScan.net and Legal Implications
IDScan.net, the New Orleans-based identity verification company, is at the center of the FBI's investigation. The company claims to provide services to more than 1,000 marijuana dispensaries in 19 U.S. states, as well as large companies like Hertz, Target, and FedEx. The discovery that driver's license data may have been stolen during transactions with IDScan.net raises questions about the security of their scanning and storage procedures. If confirmed, the breach could lead to serious legal consequences for the company, including fines and lawsuits from victims.Security Measures and Data Protection
This incident underscores the importance of adopting robust security measures to protect personal data. Companies handling sensitive information must implement advanced security protocols, such as data encryption, multi-factor authentication, and strict controls on database access. Additionally, it is crucial that data protection regulations, such as the GDPR in Europe, are respected and strictly enforced in the United States as well.Advice for Citizens
For citizens, it is essential to carefully monitor the use of their identity documents and be aware of the risks associated with sharing personal information. Some useful tips include:Ongoing Investigation and Future Perspectives
The FBI investigation is still ongoing, and further details may emerge in the coming months. The discovery of Nexus represents a wake-up call for the entire identity verification industry, pushing companies to review their security practices. Additionally, it could lead to a broader debate on the need for stricter legislation to protect personal data and prevent breaches of this magnitude. The emergence of Nexus is a reminder of the vulnerability of personal data in an increasingly digitalized world. While investigations continue, it is crucial that both companies and citizens adopt proactive measures to protect sensitive information and prevent future security incidents. Collaboration between authorities, security experts, and citizens will be key to addressing this growing threat.Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication or an editorial product under Law No. 62/2001 and does not provide real-time information.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the misuse of the information published.
In the Crypto sector, every investment involves risks: the reader is invited to always inform themselves independently before making any decision.