A dark web service selling digital scans of more than 153 million driving licences from the United States and Canada has drawn an FBI investigation into an apparent breach at an identity verification provider.
The service, called Nexus, surfaced on the Russian cybercrime forum Exploit and advertised identity documents on more than 170 million people in North America. Alongside the driving licences it listed more than 10 million identification cards, more than three million travel documents, and at least 579,000 medical cards. Its operators claimed to have been exfiltrating data for over a year, and the licence count grew by nearly 400,000 in a single day.
The scale appears genuine. A blank search returned roughly 11.5 million pages of results at about 15 results per page. Canadian licences alone returned around 1.1 million, the largest concentration from Ontario at 473,673.
The records share a distinctive format. Each licence came with six image files: front and back in a plain scan, plus infrared and ultraviolet versions of the same, each carrying a date and timestamp. Infrared and ultraviolet capture is used to read security features printed into a licence that are not visible to the eye, and is a function of dedicated document scanners rather than cameras.
Krebs on Security traced the pattern by checking records belonging to nine acquaintances who agreed to help. Each confirmed travelling on or close to the timestamp dates. The common thread was not airport security but rental car counters, several of them Hertz, and in one case a Las Vegas marijuana dispensary.
The New Orleans identity verification firm idscan.net announced an exclusive verification agreement with that dispensary chain in 2022, lists Hertz among its customers, and states that its technology scans identity documents with both infrared and ultraviolet light. The company says it performs more than 21 million verifications a month at over 20,000 locations.
idscan.net said it was investigating the matter. The FBI told Krebs on Security that its New Orleans field office had opened an official investigation into an apparent breach involving the company. No breach has been confirmed by idscan.net and no allegations have been proven.
Records offered for sale included the licences of US Defense Secretary Pete Hegseth and the FBI assistant director. Larry Baldwin of the security firm Cybera noted the exposure for people who cannot change their appearance and depend on anonymity, including those fleeing domestic violence and people in witness protection.
The Nexus site disappeared shortly after publication, replaced by a message reading “This service is no longer available.”
Sources: Krebs on Security
–
By the ID Tech Editorial Team
