FBI Probing Potential Leak of 153 Million+ U.S. and Canadian Driver’s License Scans

WEST PALM BEACH, FL – The FBI is investigating what could become one of the largest exposures of government-issued identification documents ever reported, after a new dark-web service began offering access to more than 153 million driver’s license scans from people in the United States and Canada.

The service, called Nexus, surfaced in late August on the Russian-language cybercrime forum Exploit. Its operators claimed to possess identity records covering more than 170 million people, including more than 153 million driver’s licenses, 10 million identification cards, 3 million travel or international identity documents and approximately 579,000 medical cards.

The numbers have not yet been independently confirmed by law enforcement. However, cybersecurity journalist Brian Krebs, who first reported the incident, found his own Virginia driver’s license among the records and subsequently checked the database for a number of other people with their permission. Nine individuals whose licenses were found reportedly confirmed that the documents were authentic.

More troubling, the database appears to contain considerably more than ordinary photographs of identification cards. Some records include images of both sides of a driver’s license along with infrared and ultraviolet scans, which are used by identity-verification systems to examine security features built into government-issued IDs.

Evidence uncovered by Krebs points toward IDScan.net, a Louisiana-based identity-verification company whose technology is used to scan and authenticate identification documents. Several people whose licenses appeared in Nexus were able to match timestamps attached to the stolen images with occasions when their licenses had been scanned, including car-rental transactions. Other evidence connected records to businesses known to have used IDScan technology.

The connection has not yet been conclusively established. IDScan.net has not publicly confirmed that its systems were breached or that all of the Nexus records originated from its network. The company said it was investigating the matter. The FBI confirmed on September 2 that it was also looking into the incident but declined further comment because of the ongoing investigation.

The operators of Nexus claimed they had been continuously extracting information from the unidentified source for more than a year. Krebs reported that the number of driver’s license records available through Nexus increased by nearly 400,000 records within approximately 24 hours, potentially indicating continuing access to whatever system supplied the data. That claim and the precise method of intrusion remain unverified.

Shortly after the incident became public, Nexus disappeared from the dark web, with its login page replaced by a message stating that the service was no longer available. That does not mean the underlying database has disappeared or that copies were not previously sold or distributed.

The incident is particularly serious because government identification information cannot be changed as easily as a compromised password or credit-card number. High-quality scans containing photographs, addresses, birth dates, license information and document security features could potentially be valuable for identity theft, fraudulent account creation and attempts to defeat identity-verification procedures.

For now, the most important unanswered questions are whether IDScan.net was actually breached, how attackers obtained access, how long that access persisted, exactly how many unique individuals are affected and whether the stolen database has already been copied or sold elsewhere.

The FBI investigation is ongoing.

John Colascione

About The Author: John Colascione is Chief Executive Officer of SEARCHEN NETWORKS®. He specializes in Website Monetization, is a Google AdWords Certified Professional, authored a how-to book called ”Mastering Your Website‘, and is a key player in several online businesses.