TL;DR
A breach at an identity verification company led to over 153 million driver's licenses being sold on the dark web, exposing the risks of over-collecting sensitive ID data.
A new dark web service called Nexus is selling scanned copies of over 153 million North American driver's licenses, with data continuously being updated. The scans are not simple copies; they include infrared and ultraviolet images and timestamps.
Where did the data come from?
By asking friends and family to search for their own licenses, the author found that the timestamps on each record matched the dates they had traveled or rented cars. A crucial clue: the author's and his mother's licenses had timestamps just a few seconds apart because they had handed their IDs to a car rental agent at Hertz at the same time.
Who is the culprit?
The trail led to idscan.net, a company that scans and verifies IDs for businesses, with clients including Hertz, Target, and numerous marijuana dispensaries. The FBI has opened an investigation.
The author warns that as more services require ID verification, sensitive data is being stored by third-party vendors with insufficient oversight. The real issue is not just this breach, but the systemic problem of identity data being collected without robust protection.
Curated from high-quality sources, with concise summaries and key takeaways.
