Dark web service reported to be selling scans of more than 153 million US and Canadian drivers licences.
Brian Krebs reports a hacker selling searchable access to 153 million US and Canadian licences, with suspicion pointing at the vendor IDScan.net. Any age gate built on a document scan owns that exposure.
Perspective Coverage
7 publishersReality
IDScan.net says an unauthorized third party may have accessed or copied full names and government-issued ID numbers from customer accounts on its cloud, after 153 million driver's licenses appeared for sale on a dark web site.
Perspective Coverage
5 publishersReality
The company says it learned on or around September 1 that data in customer accounts on its cloud may have been copied, and its notice lists names and ID numbers but not the licence scans Nexus was selling.
Perspective Coverage
6 publishersReality
Krebs On Security watched the database grow by nearly 400,000 records in one day, matching Nexus's own claim of more than a year of continuous exfiltration from an identity verification company.
Reality
The vendor runs more than 21 million document checks a month for clients including Hertz, GameStop and FedEx, and the plaintiffs suing in New Orleans infer their own exposure from a car rental because nobody has told them otherwise.
Reality
KrebsOnSecurity traced the records toward New Orleans ID-verification vendor IDScan after nine people matched timestamps on their stolen scans to the day they handed a license over. The FBI's New Orleans field office says it is looking into the incident.
Reality
The infrared and ultraviolet captures a bank reads to prove a license is genuine were reportedly on sale beside the ordinary scans, which leaves the cheapest step in account opening deciding nothing on its own.
Reality
IDScan.net sells the compliance layer behind age and ID checks at thousands of dispensaries and at Hertz, and Techdirt notes its trust page stayed up for days after the dark web store opened. The FBI is now asking where the images came from.
Reality
The toolkit proves a fact such as being over 18 without the document leaving the handset, which is the opposite of the vendor model behind 153 million stolen licence scans, and so far no regulator has confirmed that it accepts this method as valid proof.
Reality