The FBI is reportedly investigating a major identity theft operation after digital scans of more than 153 million driver’s licenses appeared for sale on the dark web. The stolen cache also includes medical cards, residence cards, and other sensitive documents obtained through a large-scale security breach.
According to security researchers, the licenses belong to individuals in the United States and Canada. The data appears to have been collected by compromising an identity verification service used by major corporations.
How the Breach Was Confirmed
A new identity theft service launched on the dark web this week, operating under the name Nexus, is offering the driver’s license scans for sale. The authenticity of the criminals’ claims was verified when researchers were provided with an accurate scan of a known individual’s license, and additional victims separately confirmed that their own scans were correct.
The people behind Nexus say the images come from an active breach at a major identity verification company whose clients include multiple Fortune 500 businesses. The criminals also claim they still retain access to the source of the scans, a statement supported by their addition of nearly 400,000 new records within a single 24-hour period.
Possible Source and FBI Inquiry
The New Orleans field office of the FBI has reportedly launched an official inquiry into the origin of the images. The identity verification firm appears to be based in Louisiana, according to reports tracing the leak.
Indications suggest that at least some of the data was stolen from a verification service used by rental car company Hertz. The New Orleans-based company identified as a potential source counts Hertz, Target, FedEx, Motorola Solutions, Jack Henry, and Caesars Entertainment among its clients.
A Growing Threat to American Consumers
Breaches of this kind have become increasingly common, and the consequences for consumers can be severe. Stolen driver’s license scans can be used to open fraudulent accounts, bypass verification checks, and carry out further identity theft.
The scale of the problem continues to expand. Recent estimates indicate that online scams cost Americans nearly EUR 129 billion in the past year, as the volume of cyber scams rises sharply. In this case, the very service designed to confirm identities became the entry point for a breach capable of enabling widespread identity theft.
Source
Image: 9to5mac.com
