153 Million Driver’s License Images Allegedly Offered on Dark Web
Summary
More than 153 million driver’s licenses were offered on the Nexus identity-theft service. The seller alleged a breach at an identity-verification firm; Brian Krebs assessed the documents likely came from IDScan.net. The FBI reportedly opened an investigation.
Key points
- Nexus listings included more than 153 million driver’s licenses, along with millions of other identity and travel documents and about 580,000 medical cards.
- A threat actor claimed to possess IDs belonging to more than 170 million people and alleged the documents came from an active breach at an identity-verification firm.
- After finding his own and others’ licenses on Nexus, journalist Brian Krebs assessed that the documents were likely taken from IDScan.net; the company had not responded to SecurityWeek at publication.
- Nexus reportedly shut down shortly after Krebs published his findings.
- The FBI apparently launched an investigation; some listed licenses reportedly belonged to FBI agents.
- An NCC Group adviser recommended mapping identity-data flows, limiting retention, setting security requirements for identity providers, and monitoring for abnormal bulk access and exfiltration.
Article Details
- Victim Organization
- IDScan.net
- Incident Type
- Suspected data breach and exfiltration of identity documents
- Data Types Exposed
- Driver's license scans
- Identification cards
- Travel documents and international IDs
- Medical cards
- Affected Records
- Nexus reportedly contained over 153 million driver's licenses, more than 10 million identification cards, over 3 million travel documents and international IDs, and roughly 580,000 medical cards. The threat actor claimed to possess IDs belonging to over 170 million individuals. These figures are reported listings and claims, not confirmed counts of records taken from IDScan.net.
- Operational Impact
- The Nexus platform was reportedly shut down shortly after publication of an article about the stolen IDs. The FBI reportedly launched an investigation into the potential IDScan.net breach.
- Ransom Or Extortion
- No ransom demand or extortion activity was reported. A threat actor offered the identity documents on Nexus.
- Claim Status
- alleged