FBI Probes Sale of 153 Million Driver’s Licenses on Dark Web
The Federal Bureau of Investigation (FBI) is investigating an apparent data breach involving driver’s licenses and other information for sale on the dark web.
The breach came to light after cybersecurity blogger Brian Krebs reported that a website called Nexus was selling access to more than 153 million U.S. and Canadian driver’s licenses. Nexus also claimed to have millions of other identification and travel documents, including ten million ID cards and two million travel documents. The site has since ceased operating.
Krebs said he was able to verify that some of the documents were legitimate, including his own driver’s license, and found that the site appeared to update its database of stolen data in real time, suggesting it was being fed by a live breach.
Krebs also said that he was able to see a preview of information on Defense Secretary Pete Hegseth for sale, as well as information on an FBI assistant director.
The FBI’s New Orleans field office opened an investigation into the apparent breach earlier this month.
“Due to the ongoing nature of the investigation, we decline to comment further,” a spokesperson for the FBI New Orleans field office said.
IDScan.net acknowledges security incident
The apparent breach may be connected to New Orleans-based identity-verification company IDScan.net, which provides identity-verification software.
The company acknowledged that an unauthorized third party may have accessed or copied customer information stored in its cloud.
IDScan.net says it immediately launched an investigation upon learning of the potential breach and that it is cooperating with federal law enforcement.
Cybersecurity Standards
The incident has prompted cybersecurity researchers to call for stronger standards and oversight as more businesses rely on third-party vendors to verify identities and driver's licenses.
“These systems are putting sensitive data into more and more 3rd-party vendors, and we don’t have nearly the oversight to ensure they are safe,” cybersecurity researcher Zach Edwards told Krebs
Edwards also told Krebs that his own driver’s license was among the information compromised in the breach.
