Loading today’s stories
Product2 distinct publishers2 min readPublished
Stolen scans of 153 million drivers licences found for sale on dark web marketplace
A dark web service says its licence images come from a live breach at an identity verification company whose customers include Fortune 500 names, which makes an uploaded document a weaker check for everyone downstream.
The Product Desk · Product desk
What happened
- A dark web service called Nexus is offering more than 153 million driving licence scans, plus 10 million other ID cards, three million travel documents and at least 579,000 medical cards.
- KrebsOnSecurity verified the haul after the sellers produced a scan of the reporter's own driving licence, and other people confirmed that the images of theirs were accurate.
- Krebs's evidence pointed to Louisiana-based IDScan.net, whose verification technology is used by car rental firms, hotels, retailers and marijuana dispensaries.
- The FBI's New Orleans field office has opened an official inquiry into the source of the images, without issuing any public statement about it.
- Nexus vanished from the dark web shortly after the Krebs report, replaced by a notice saying the service was no longer available, with no way to tell whether copies still circulate.
Compiled by The Product DeskSomething wrong?How this is made
Why it matters
- constraint Nexus says its source is a major identity verification company serving multiple Fortune 500 customers, so any team buying document checks has to treat the input as compromised while having no way to tell whether its own vendor is the one.
- contradiction The sellers describe access that is still live while IDScan.net says it has not determined whether unauthorized access occurred, and that gap decides whether downstream customers are remediating a closed incident or one still filling up.
- exposure Security researchers say the photographs and addresses reach people whose safety depends on not being locatable, including domestic violence survivors and those in witness protection, so the cost falls on people who never picked the vendor.
- decision The client list 9to5Mac attributes to the New Orleans company runs through Hertz, Target, Fedex, Motorola Solutions, Jack Henry and Caesars Entertainment, and each of them now has to decide whether holding licence images is worth what they cost on the way out.
The victims who confirmed their own records did it by reading a timestamp. Several told KrebsOnSecurity the date on the image matched the day they had handed a licence over while travelling or renting a car [14]. The capture point was a counter transaction, and the image stayed in a system long after the clerk waved them through.
Fidelity is what makes the set valuable to a buyer. Some records hold several images of the same licence, front and back, shot under infrared and ultraviolet light [13]. Those are the channels scanner hardware reads to check the security printing on a card, which means the stolen files arrive in the format an automated check is hoping to see.
The scale claim survives crude arithmetic. A blank search on the service returned about 11.5 million pages at roughly 15 records a page [11], which multiplies out to about 172.5 million records against the 170 million the seller advertised [18][2]. Roughly 1.1 million were Canadian, more than 473,000 of those from Ontario [12], and Krebs reported senior US officials in the set, including Defense Secretary Pete Hegseth [15]. The sellers also said the tap was still open, adding nearly 400,000 scans inside 24 hours [6]; at that pace the pile grows by around 12 million a month [19].
Teams assume a document check proves the person is who they claim to be. In practice it captures an image and keeps it, because the kept image is the audit artifact. The control was built for the compliance file, not for the user. That file is what turned into inventory.
For each flow in your product that asks a user for a document, ask two questions. Does the decision need the image after the decision has been written. And would the outcome change if you assumed the image were already public. Put those on axes and only one box of the four is dangerous: image retained, document match doing the work alone. A flow sitting in that box now has a control whose input a stranger can buy [1].
Getting out of that box means pairing the document with a signal the verification vendor never handled, and deleting the image once the decision is logged. The cost lands on the compliance side of the house. You give up the picture you would have shown a regulator or a card network, and you have to argue that a decision log plus a hash of the image is enough evidence of diligence. The argument is easier to make this week because the vendor named in the reporting isn't yours [7].
What to watch
- Whether IDScan.net's investigation concludes that unauthorized access occurred, and how far back any exposure runs.
- Whether the FBI's New Orleans inquiry names a source, which would tell downstream customers whether their own users are in the set.
- Whether the verification vendors selling document capture start offering a no-retention mode, and what they charge for it.
Loading claim ledger
Loading source directory links
Loading share composer
Loading topic controls
Loading related stories