Security
153 Million Driver's Licenses on Dark Web After Car Rental Breach
A newly discovered service called Nexus is trafficking in high-resolution scans of driver's licenses and other government IDs, with the FBI now investigating the sprawling identity theft operation.
Ars Technica
A car rental transaction became a window into a massive ID theft operation: within hours of an employee scanning a driver's license at a major car rental company, a detailed scan of that ID appeared for sale on the dark web.
According to an investigation published by KrebsOnSecurity, the discovery surfaced a service known as Nexus that is actively marketing over 153 million driver's licenses to potential buyers. The stolen IDs include those belonging to well-known figures, among them journalist Brian Krebs himself, his family members, an FBI assistant director, and multiple security researchers.
The Threat Level#
The stolen documents go far beyond standard photocopies. Each listing reportedly contains multiple image files of both sides of the ID, along with specialized captures in the infrared and ultraviolet ranges. Such multi-spectrum images could potentially enable fraudsters to fabricate counterfeit IDs sophisticated enough to defeat security features like holograms and other anti-tampering measures.
Beyond Driver's Licenses#
Nexus's catalog extends well beyond state-issued driver's licenses. The service advertises access to:
- State identification cards
- Travel documents
- International driving licenses and IDs
- Medical identification
- Military Common Access Cards
- Residence permits
- Work authorization documents
- Marijuana dispensary membership cards
The latter category illustrates the breadth of the breach: at least one victim confirmed visiting a Las Vegas location of Planet13, a multi-state cannabis retailer.
Investigation Underway#
Details embedded in the stolen records point toward multiple potential sources of the compromised data. Some entries reference "CDL" as their origin—likely denoting commercial driver's licenses—while others list "CAC," which may refer to Common Access Cards issued by the government to control access to federal buildings and secure facilities. The FBI has launched an investigation into the Nexus operation.
