Hackers stole 153 million scans of driver’s licences from IDScan.net, a Louisiana-based identity verification service, exposing documents from people across the US and Canada that were later offered for sale on the dark web.
The records appeared on a service called Nexus. Visitors to the platform could find over 153 million driver’s licences, more than 10 million identification cards, over 3 million travel documents and international IDs, and roughly 580,000 medical cards.
Only around 1.1 million of the driver’s licences were from Canada. The licence records included photographic, ultraviolet (UV) and infrared (IR) scans, providing several forms of image data from the same documents.
Driver’s licences are often widely accepted for opening credit lines and bank accounts. Their theft therefore creates a direct risk for people whose documents were processed through the service, although the available information does not establish how many records were accessed or bought before Nexus was taken offline.
IDScan.net has contracts with thousands of dispensaries, Hertz, FedEx and Target. It says it works with large brands across a dozen industries, including automotive, banking and fintech, gaming, education, transportation, hospitality, law enforcement, retail and security.
The company performs over 21 million verifications each month at more than 20,000 locations. Time stamps found on scanned driver’s licences and other identity documents coincide with the time victims used their IDs at those companies, linking at least some of the files to customer verification transactions.
Brian Krebs reported the breach. Krebs on Security confirmed the authenticity of the claim after receiving a scan of Krebs’s own driving licence. Security researcher Zach Edwards’ ID was also found in the breach.
Pete Hegseth, the current U.S. Defense Secretary, had his ID found in the stolen data. Some of the driver’s licences taken by the threat actor behind Nexus apparently belong to FBI agents.
The hackers had been continuously exfiltrating data for over a year, according to the information published on Nexus. On the day the breach was revealed, 400,000 additional records were added to the available database. The data increased by nearly 400,000 records within a 24-hour period before the service was shut down.
Nexus was shut down shortly after Krebs’ article on the stolen IDs was published. The New Orleans field office of the Federal Bureau of Investigation launched an official inquiry into the source of the images.
An IDScan spokesperson told Krebs: “At this point I'm not able to share any additional information, but the updates you have provided have been welcome and helpful to our team's investigation”.
The identity of the hackers remains unknown. It is also unclear how they first gained access to IDScan.net’s systems, when the breach began, when the company first detected it, or whether the records have been copied to other dark web services. There is no information on any ransom demand, the price charged for access to Nexus, or the total number of people who obtained the documents before the platform closed.
Comments (0)