Over 153 Million Scanned Driver's License Found For Sale On Dark Web, Some For Just $100

The New Orleans field office of the FBI launched an official inquiry Tuesday into a new identity theft service on the dark web that sells digital scans of over 153 million driver's licenses and over 10 million identification cards from U.S. and Canadian residents. According to reporting done by KrebsOnSecurity, the dark-web database appears to be siphoning images of driver's licenses and legal identification cards collected by an identity verification company based in Louisiana called idscan.net. About two hours after Krebs On Security published the original report of the massive operation, the website vanished from the dark web, but that doesn't mean the story ends there.

Author Brian Krebbs is a computer and internet security expert who was a Washington Post reporter for 14 years before working for several other publications as a cyber security expert. Krebbs was tipped off on this story because it was brought to his attention that his Virginia driver's license was used as a free sample in the dark web site's sales thread on Exploit, a Russian cybercrime forum. U.S. Defense Secretary Peter Hegseth's driver's license was also found for sale on the site.

The service was called Nexus, and Krebbs found identity records in the form of driver's licenses, identification cards, marijuana dispensary cards, government identification cards, medical cards, and other travel documents, but no passports. Each file on Nexus showed a date and timestamp, which allowed Krebbs to narrow down potential sources of his own leaked information, as well as some of his friends and family members.

Krebbs got permission from over a dozen of his friends and family members to search for their licenses on Nexus, and found nine of their licenses on the site. He was able to confirm that each person had traveled on or very close to the dates and timestamps attached to the images, and he also found correlations to the frequently controversy embroiled car rental company Hertz. He found that three of his connections whose licenses were on Nexus had not used their license to fly, but only used them at Hertz to rent cars, and he found that the timestamp on one of his license photos corresponded with one of his mother's license, and that they both handed their licenses over to Hertz just moments apart from each other.

Krebbs contacted idscan, which said it was investigating the matter but has not yet shared an official statement or substantive reply. He also spoke with Larry Baldwin, principal intelligence researcher at cybersecurity firm Cybera, who said, "the Nexus identity theft service presents multiple serious security and privacy threats, noting that state-issued driver's licenses are commonly used as proof of one's identity when opening new lines of credit. Baldwin said the service could also dangerously expose many people who do not wish to be found but who cannot meaningfully change their appearance (or at least not enough to fool today's AI-based image matching tools)."

The latest update regarding this massive leak of sensitive personal information is still that the Nexus website was no longer visible on the dark web, but we will continue to monitor the situation for updates.