Over 153 million scans of driver's licenses of US and Canadian citizens discovered on the dark web

Data leak on the dark web

According to НВ — Техно: On September 3 at 1:03 PM, news broke of a serious data leak: scans of over 153 million driver's licenses of US and Canadian citizens appeared on the dark web. Cybersecurity journalist Brian Krebs, who was the first to report this situation, indicated that the likely source of the leak is the American company IDScan, which specializes in document and identity verification.

Cybercriminals, taking advantage of this data, launched a service called Nexus on the dark web, where they sold stolen documents. Among the stolen data were not only driver's licenses, but also medical cards, employment documents, and proof of residence. To verify the authenticity of the data, the perpetrators even sent journalist Krebs a scan of his own driver's license, which he was able to confirm as genuine. Other victims also verified the authenticity of their documents, including a scan of the driver's license of US Secretary of Defense Pete Hegseth.

Investigation and consequences

IDScan is reportedly used for client verification when renting cars by companies, including Hertz. A significant number of affected individuals likely rented cars from Hertz. Additionally, IDScan's services are utilized by companies such as:

• Target
• FedEx
• Motorola
• Jack Henry

The Federal Bureau of Investigation (FBI) has already begun investigating the incident, which is being led by the field office in New Orleans. The Nexus service, which was previously actively advertised on the Russian-speaking cybercrime forum Exploit, has already ceased operations. However, stolen copies of documents may remain with the perpetrators and other individuals. Recently, it was also revealed that over 70,000 government documents of users were exposed on Discord due to the hacking of a third-party vendor.

This situation highlights the serious threats that exist in the field of cybersecurity. A data leak of such scale can have far-reaching consequences for the personal safety of the affected individuals and also emphasizes the need to strengthen data protection measures in companies that handle sensitive information.

Brian Krebs

The FBI's investigation aims not only to identify the source of the leak but also to prevent similar incidents in the future.

The implications of data leaks extend beyond just personal documents. Recent findings indicate that fraudsters can exploit online reviews to identify individuals, potentially putting their friends at risk as well. As cybercriminals become more sophisticated, understanding these connections is crucial for safeguarding personal information.