FBI Investigates Theft of Millions of Driver's Licenses Sold on Dark Web

The FBI has launched an investigation into the theft of millions of stolen Americans' and Canadians’ driver’s licenses.

The new probe was announced as Brian Krebs, a former Washington Post reporter with a background in cybersecurity, exposed a dark web service called Nexus that was allegedly selling digital scans of more than 153 million driver’s licenses, mostly from people in the U.S., but also many in Canada.

“Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana,” Krebs wrote in his blog “Krebs on Security” last Tuesday.

Krebs started digging into the matter after a source tipped him off last Monday. Nexus had advertised their service on the Russian cybercrime forum Exploit, offering Krebs’ Virginia driver’s license as a free sample, the independent journalist reported.

Those behind Nexus claimed the stolen license images come from an active breach at “a major identity verification company,” which Krebs traced back to New Orleans-based IDScan.net.

Out of more than a dozen relatives and friends that Krebs asked permission to search their licenses on Nexus, nine were found and each of those nine had traveled on or very close to the dates in the timestamps attached to their photos.

Krebs then discovered a commonality among some of those travelers — they rented vehicles from Hertz, including Krebs himself.

The journalist also found the driver’s license of Zach Edwards, a security and privacy researcher, on Nexus. Edwards said the timestamp on his record was taken during a trip to Las Vegas last month. During the trip, he said he went to the marijuana dispensary Planet13, where his ID was scanned.

Krebs found the link between Hertz and Planet13 — they have both been customers of identity verification provider IDScan.net. The identity firm says it performs more than 21 million verifications monthly at more than 20,000 international locations.

IDScan.net has confirmed to Krebs that it was investigating the matter.

“At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation,” Jillian Kossman, a marketing and operations leader at IDScan.net, told Krebs.

The Independent has reached out to Hertz and IDScan.net for comment.

Krebs first reported that the FBI’s New Orleans field office launched an official inquiry into the source of the stolen ID images.

“During the course of my research for this story, word got around to the FBI that I was poking at the apparent source of this new identity theft service’s data. Probably they were tipped off when I shared with a trusted source that Nexus also is selling the drivers license information for the assistant director of the FBI,” Krebs said.

It’s unclear which assistant director Krebs was referring to. There are two FBI deputy directors, Christopher Raia and Andrew Bailey, and several assistant directors at the bureau from different field offices.

“Earlier this afternoon, I was added to a conference call with a half-dozen FBI agents, including senior leaders from the agency’s cyber division,” Krebs said in his September 1 report. “During that call, the FBI shared that earlier today their New Orleans field office opened an official investigation into an apparent breach involving idscan.net.”

In an update, Krebs said Nexus vanished from the dark web shortly after he published the report.