Nexus sold over 153 million driver's licenses

A dark web identity theft service called Nexus claims to be selling scans of more than 153 million US and Canadian driver's licenses, along with millions of other identity documents.

“Based on interviews with individuals whose licenses are available for purchase through the service, it appears to be stealing images collected by a widely used Louisiana-based identity verification company,” KrebsOnSecurity reportsIt also reports that the FBI in New Orleans has launched a formal investigation into the source of the images.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

On Monday, August 31, a source alerted KrebsOnSecurity to a service advertised by a new user on the Russian cybercrime forum Exploit, offering access to digital scans of ID documents for more than 170 million people in North America. KrebsOnSecurity was notified because the owner of this service offered his driver’s license as a free sample in the initial advertising post on Exploit.

The service, called Nexus, claims to have more than 153 million driver's licenses for people in the United States and Canada, as well as more than 10 million identity cards, more than three million travel documents and/or international ID cards, and at least 579.000 medical cards.

Nexus officials claim that the license images come from an active breach at “a large identity verification company” that has clients that include many Fortune 500 companies.

“We have been continuously extracting new data into our private database for over a year,” Nexus says in its introductory post to Exploit. “The files are available for preview before purchase.”

Indeed, in the last 24 hours, the number of driver's license files listed as available on Nexus has increased by nearly 400.000, indicating that recently stolen license data is being collected and uploaded to the service on a regular basis.

KrebsOnSecurity identified the source of the leak by comparing timestamps on images of stolen licenses with the time their holders scanned their IDs. The companies were using identity verification services from Louisiana-based idscan.net, whose technology scans IDs using infrared and ultraviolet rays.

After the story was published, Krebs reports that the Nexus service website “disappeared from the darkweb, replacing the login page with a simple message stating: ‘This service is no longer available.’”

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.