By Lucretia Hughes
WASHINGTON — The FBI is investigating a newly launched dark-web identity theft service that claims to possess digital scans of more than 153 million driver’s licenses from the United States and Canada, including a license belonging to Secretary of War Pete Hegseth.
The illegal marketplace, known as Nexus, reportedly offered Hegseth’s driver’s license for $100. Identification belonging to other senior federal officials, including an assistant director of the FBI, was also discovered in the database.
Cybersecurity journalist Brian Krebs first reported the massive collection after a source alerted him to an advertisement posted by a new user on Exploit, a Russian-language cybercrime forum. The person operating Nexus used Krebs’ own Virginia driver’s license as a free sample to promote the service.
According to the KrebsOnSecurity investigation, Nexus claimed to possess more than 153 million driver’s licenses, 10 million other identification cards, 3 million travel documents or international IDs and at least 579,000 medical cards.
The figures were advertised by the criminals operating Nexus and have not been independently audited. However, Krebs reported that a blank search of the marketplace produced approximately 11.5 million pages containing roughly 15 results each, suggesting the operators may not have significantly exaggerated the database’s size.
Most of the records appeared to belong to Americans. A separate search reportedly produced approximately 1.1 million Canadian licenses, including more than 473,000 from Ontario.
This was not simply a list of names, email addresses and passwords from an old data breach. Some records reportedly contained high-resolution images of both sides of a person’s driver’s license, along with infrared and ultraviolet scans that could potentially be used to create more convincing counterfeit identification.
The files also included timestamps showing when the identification documents were scanned.
Krebs searched for the licenses of more than a dozen friends and relatives with their permission. Nine were found in the database. Several timestamps matched dates when those individuals had rented vehicles from Hertz or used businesses that scanned their identification.
Krebs found his mother’s license in the system with a timestamp only seconds apart from his own. Both had presented their licenses to a Hertz representative during the same rental transaction.
Other victims connected their records to car rentals and a Las Vegas marijuana dispensary. Those common links led Krebs to investigate IDScan.net, a New Orleans-based identity verification company whose technology reportedly processes more than 21 million ID verifications every month at more than 20,000 locations worldwide.
IDScan.net has publicly listed major companies and organizations as customers of its identity verification products. The company’s technology can capture regular, infrared and ultraviolet images of identification documents, matching the types of files appearing on Nexus.
That connection does not prove IDScan.net was breached or establish that every business using its technology was affected.
IDScan.net told Krebs that it was investigating the allegations but had not reached any conclusion about whether unauthorized access occurred or what information may have been compromised. The company reportedly activated its incident-response procedures, began preserving system logs, contacted law enforcement and started engaging an independent forensic firm.
The Retail and Hospitality Information Sharing and Analysis Center also reported that IDScan.net had not confirmed the breach or its scope.
The operators of Nexus claimed they had been stealing information continuously for more than a year from a major identity verification company serving Fortune 500 businesses. In one 24-hour period, the number of driver’s license records advertised by the service reportedly increased by nearly 400,000.
That suggests this may not have been an old database quietly circulating among criminals. If the operators’ claims were truthful, stolen identification may have been entering the system almost in real time.
The FBI’s New Orleans field office opened an official investigation after learning that Nexus contained identification belonging to one of the bureau’s assistant directors. Krebs said he participated in a conference call with several FBI agents, including senior members of the bureau’s cyber division.
Shortly after Krebs published his report, the Nexus website disappeared from the dark web. Its login page was replaced with a message stating that the service was no longer available.
But a website disappearing does not mean the stolen information has been destroyed. Copies may already have been downloaded, sold or transferred to other criminal organizations.
The alleged exposure of Hegseth’s license raises additional national-security concerns. Hegseth is officially identified by the Department of War as the nation’s secretary of war. Other records on Nexus were reportedly labeled “CAC,” an abbreviation that may refer to Common Access Cards used to enter government buildings and secure areas.
It remains unclear whether any active federal access credentials were compromised.
For ordinary Americans, the danger is just as real. Driver’s licenses are routinely used to verify identities when people open financial accounts, apply for credit, rent property, recover locked accounts or complete government transactions.
A criminal armed with a high-resolution license scan, photograph, home address, date of birth and signature could have a powerful foundation for identity theft, financial fraud and targeted phishing attacks.
This incident also exposes a larger problem: Americans are being required to surrender copies of their government-issued identification to an expanding network of rental companies, retailers, medical facilities, hotels, financial institutions, age-verification services and private technology vendors.
The customer may hand a license to a familiar business, but the information can pass through systems operated by third-party companies the customer has never heard of and never knowingly chose to trust.
Companies should not be permitted to collect and retain sensitive identification indefinitely without strong security requirements, strict deletion policies and full accountability when that information is exposed.
Americans who believe their identities may be at risk should closely monitor their financial accounts and credit reports. The Federal Trade Commission advises consumers that credit freezes and fraud alerts are free and can make it harder for identity thieves to open new accounts.
A credit freeze must be placed separately with Equifax, Experian and TransUnion. Anyone who discovers evidence of identity theft can report it through IdentityTheft.gov and receive a personalized recovery plan.
This investigation is still developing, and the full number of victims remains unconfirmed. However, the evidence uncovered by Krebs should serve as a warning to government agencies, private businesses and every American who has been told, “We just need to scan your ID.”
Once your personal information enters someone else’s database, you are trusting that company — and every vendor connected to it — to protect something you cannot simply replace with a new password.
The Real News with Lucretia Hughes — bringing the receipts, defending the Constitution and telling the truth the establishment would rather ignore.
Original article
Comments