Over 153 million driver's licenses available for sale on dark web marketplace
A dark web service called Nexus has been offering high-resolution scans of driver's licenses and other government-issued IDs, with the FBI investigating.
What happened
Within hours of renting a car from a major rental company, an Ars Technica reporter's driver's license appeared for sale on the dark web through a service called Nexus, according to an exposé published by KrebsOnSecurity. The marketplace claimed to have over 153 million driver's licenses available, including those of journalist Brian Krebs, his mother, an FBI assistant director, and security researchers. The listed files reportedly included high-resolution scans of both front and back of IDs, as well as infrared and ultraviolet spectrum images—formats that may enable counterfeit IDs to bypass hologram security tests. Nexus also advertised other forms of identification including travel cards, Common Access Cards (government IDs granting access to secure facilities), medical cards, employment authorizations, and marijuana dispensary cards. Some records indicated sources as "CDL" (potentially commercial driver's licenses) and "CAC" (Common Access Cards). The FBI is investigating the breach.
Context
The scale and nature of this breach poses significant identity theft and security risks. The inclusion of government-issued identity cards, particularly Common Access Cards used for physical access to secure government facilities, and the capture of security features in multiple light spectrums, suggests attackers have obtained credentials usable for both civilian and potentially national security purposes. The apparent sourcing of records from car rental companies and marijuana dispensaries indicates the breach may involve compromised data collection points where IDs are routinely scanned during transactions. The growing daily inventory reported by Krebs suggests ongoing access to new batches of identification data.