What we know so far: A dark-web service that claimed to sell scans of more than 153 million US and Canadian driver's licenses has gone offline after Krebs on Security identified it. Before disappearing, the site offered ID images that appeared to include standard scans as well as infrared and ultraviolet versions used in document-verification systems. This development points to a potentially far-reaching compromise of the systems businesses use to verify physical IDs.
The service, called Nexus, offered records for driver's licenses, ID cards, travel documents, medical cards, and other credentials. Krebs on Security reported that the FBI's New Orleans field office has opened an inquiry into an apparent breach involving Louisiana identity-verification company IDScan.net.
Nexus said it had collected data from "a major identity verification company" and had been adding new records for more than a year. It claimed to hold more than 153 million driver's licenses, more than 10 million ID cards, over 3 million travel and international ID documents, and at least 579,000 medical cards.
Krebs found that a search with no terms returned about 11.5 million pages of records, with roughly 15 results on each page. Most of the licenses appeared to belong to people in the United States. A search limited to Canadian driver's licenses produced about 1.1 million records, including nearly 474,000 from Ontario.
The records included more than the usual front-and-back images. Krebs found multiple files tied to a single license, including visible-light images and versions captured in infrared and ultraviolet. Those formats are commonly used to check security features on identity documents.
Krebs compared timestamps attached to several records with the travel and rental histories of people whose licenses appeared on Nexus. In several cases, the dates aligned with when those people handed over their IDs at rental-car counters, dispensaries, or other businesses.
Krebs found scans of his own license and his mother's license with timestamps only seconds apart. Both had presented their licenses to a Hertz employee while renting a car. His mother said that was the only time she had shown her license that day.
Cybersecurity researcher Larry Baldwin also found his license in the service. He said its timestamp matched the date of a recent Hertz rental. Privacy researcher Zach Edwards found a record tied to a recent trip to Las Vegas for the DEFCON security conference. Edwards said he had shown his license at airport security, at the Aria hotel, and at a Planet13 marijuana dispensary. The dispensary was the only place he knew had scanned the card with a device.
Those examples do not prove where the data came from. But they led Krebs to examine IDScan.net, a New Orleans company that provides ID-verification technology to businesses.
IDScan.net says its systems process more than 21 million verifications each month at more than 20,000 locations worldwide. The company says its technology captures IDs in both infrared and ultraviolet light. Its website lists Hertz, Target, FedEx, Motorola Solutions, and Jack Henry among its customers. It also announced an exclusive deal with Planet13 in 2022 and says it works with more than 1,000 marijuana dispensaries in 19 states.
IDScan.net told Krebs it was investigating but did not provide details.
The incident is more serious than a typical breach involving names, addresses, and license numbers. Driver's licenses are widely used to open accounts, verify age, rent vehicles, and confirm identity. The infrared and ultraviolet images may give criminals access to data that is normally used to authenticate a physical document.
Nexus also listed marijuana dispensary cards, and some records were marked "CDL," which may refer to commercial driver's licenses. Others were marked "CAC," possibly referring to Common Access Cards used to enter government facilities and secure areas.
Baldwin told Krebs the data could be especially dangerous for people trying to keep their locations or identities private, including domestic-violence survivors and people in witness protection programs.
The service's login page later changed to a plain message: "This service is no longer available."
The FBI investigation is expected to examine how the records were obtained and whether the data was copied or shared before Nexus disappeared.
Image credit: Krebs On Security
A dark-web site claimed to sell 153 million driver's licenses, then vanished
