The FBI is investigating a report that tens of millions of drivers’ licenses from the United States and Canada are being sold on the dark web.
Independent journalist Brian Krebs, 52, discovered the illicit marketplace Tuesday after it was advertised on a Russian cybercrime forum. His own driver’s license was offered as a free sample, he said.
Krebs confirmed the authenticity of the data with nine individuals whose information appeared on the site. The service, dubbed Nexus, claimed to hold tens of millions of licenses from the US and Canada, plus millions of other identification cards and travel documents and hundreds of thousands of medical records.
The site appeared to be updating its database in real time, Krebs reported, indicating it was being fed by a live breach rather than a static dump of old data.
Zach Edwards, a threat researcher at cybersecurity company Infoblox, called the incident unprecedented in scope.
“There’s never been a breach of driver’ s licenses at this scale,” Edwards said. He added that his own license was available for sale on the site. “I looked good,” he joked, before turning serious about the implications.
Edwards continued that the ongoing nature of the breach “means that this attack created legitimate national security risks for high-profile individuals.”
The FBI issued a brief statement Wednesday acknowledging it was “looking into the incident” but declined further comment “due to the ongoing nature of the investigation.” The bureau did not specify how long it had been aware of the marketplace or whether any arrests were imminent.
If fully confirmed, the breach would rank among the largest-ever exposures of government-issued identity documents in North America. The compromised data creates significant risks of identity theft and fraud for tens of millions of people whose licenses are now circulating in criminal marketplaces.
Krebs quoted a representative of New Orleans-based identity verification provider IDScan.net as saying the company was investigating the matter. IDScan.net, which describes itself as providing “ID fraud prevention at scale,” did not return repeated messages seeking comment.
The dark web site vanished shortly after Krebs published his report, though it was unclear whether the operators shut it down voluntarily or moved to a new location to avoid law enforcement attention.
The source of the stolen data remains unconfirmed, and the outlet could not establish how the documents were originally obtained.
PAGES: