The FBI is investigating a potentially massive data breach involving digital copies of tens of millions of driver’s licenses belonging to people across the United States and Canada, after the documents were reportedly discovered for sale on the dark web.
Independent cybersecurity journalist Brian Krebs disclosed Tuesday that he had located a dark web marketplace offering scans of millions of driver’s licenses from American and Canadian residents. Krebs said he was able to verify that the information was genuine by checking the records with nine individuals whose documents appeared in the database.
The FBI confirmed Wednesday that it had opened an inquiry into the reported breach. In a brief statement, the bureau said it was “looking into the incident” but could not comment “due to the ongoing nature of the investigation.”
Should the reported scale of the compromise be verified, it could rank among the largest known breaches involving government-issued identification documents in North America. The exposure of driver’s licenses on such a scale could potentially leave tens of millions of individuals vulnerable to identity theft, financial fraud and other forms of criminal exploitation.
According to Krebs, he first became aware of the marketplace after it was promoted on a Russian cybercrime forum. In an extraordinary twist, his own driver’s license was reportedly displayed as a free sample of the stolen material. The operation, known as Nexus, claimed to possess tens of millions of U.S. and Canadian driver’s licenses, along with millions of additional identification cards and travel documents and hundreds of thousands of medical records. Krebs also reported that the database appeared to be receiving newly stolen information in real time, raising the possibility that the underlying security breach remained active.
Zach Edwards, a threat researcher with cybersecurity firm Infoblox, said the apparent size and ongoing nature of the compromise made it unlike previous driver’s license breaches.
“There’s never been a breach of driver’s licenses at this scale,” said Edwards, who added that his own license was available for sale on the site. Edwards said that the ongoing nature of the breach “means that this attack created legitimate national security risks for high-profile individuals.”
The origin of the compromised information has not yet been established. Reuters reported that Krebs cited a representative of New Orleans-based identity-verification company IDScan.net as saying the company was examining the matter. IDScan.net, which describes its services as providing “ID fraud prevention at scale,” did not respond to repeated requests for comment from Reuters.
Krebs subsequently reported that the dark web marketplace selling the driver’s license records disappeared shortly after publication of his report.
{Matzav.com}
