153 Million Driver License Images Offered on Dark Web

A threat actor has begun offering over 153 million US and Canadian driver’s license images on the dark web through an identity theft service called Nexus. The images were allegedly sourced from an active breach at IDScan.net, a Louisiana-based firm providing identity verification services, access management, and age verification services, along with an ID-activated door lock and mobile ID scanners. The company states it works with large brands across a dozen industries, including automotive, banking and fintech, gaming, education, transportation, hospitality, law enforcement, retail, and security, performing over 21 million verifications each month at more than 20,000 locations. According to investigative journalist Brian Krebs, a blank search on Nexus returned approximately 153 million results, with only around 1.1 million driver’s licenses originating from Canada. The threat actor behind Nexus claimed the documents were exfiltrated from an active breach at IDScan.net. Shortly after Krebs’s article on the stolen IDs was published, the Nexus platform was shut down. The FBI has launched an official investigation into the potential IDScan.net data breach, and some of the driver’s licenses exfiltrated by the threat actor belong to FBI agents. “The first takeaway lesson is that organizations should design identity systems on the assumption that identity evidence may eventually be compromised. A genuine-looking document cannot remain sufficient proof of identity indefinitely. Organizations should inventory identity data and establish who collects it, why it is needed, where it flows, and when it is deleted,” NCC Group senior adviser and director Tim Rawlins said. Individuals should avoid sharing copies of their driver’s licenses unless absolutely necessary and, when presenting an ID for verification, ask whether it can be checked without being scanned, photographed, or retained.