FBI investigates dark web sale of tens of millions of U.S. and Canadian driver's licenses
By Raphael Satter
WASHINGTON, Sept 2 (Reuters) - The FBI said on Wednesday that it was investigating a report that tens of millions of driver's licenses belonging to people in the United States and Canada were being offered for sale on the dark web.
The investigation was prompted by an independent report published Tuesday by cybersecurity journalist Brian Krebs, who said he had uncovered a dark web site advertising digital scans of millions of driver's licenses from both countries. Krebs said he verified the authenticity of the stolen data with nine individuals whose records appeared in the trove.
In a brief statement Wednesday, the FBI confirmed it was “looking into the incident” but declined to comment further, citing the ongoing nature of the investigation.
If confirmed, the breach would rank among the largest exposures of government-issued identity documents in North American history, potentially putting tens of millions of people at risk of identity theft and fraud.
Krebs said he first learned of the site after it was promoted on a Russian cybercrime forum, with his own driver's license offered as a free sample to attract buyers. The service, called Nexus, claimed to hold tens of millions of driver's licenses from the U.S. and Canada, along with millions of other identification cards and travel documents and hundreds of thousands of medical records. Krebs noted that the site appeared to be updating its stolen database in real time, suggesting it was being fed by a live, ongoing breach.
Zach Edwards, a threat researcher at cybersecurity firm Infoblox, said the incident was unlike anything he had seen before in terms of its scope.
“There's never been a breach of driver's licenses at this scale,” said Edwards, whoconfirmed that his own license was also listed for sale on the site. He added that the continuous nature of the breach “means that this attack created legitimate national security risks for high-profile individuals.”
Reuters was unable to determine the source of the stolen data. Krebs quoted a representative of New Orleans-based ID verification provider IDScan.net as saying the company was investigating the matter. IDScan.net, which describes itself as offering “ID fraud prevention at scale,” did not respond to repeated requests for comment from Reuters.
According to Krebs, the dark web site disappeared shortly after his report was published.
(Reporting by Raphael Satter; Editing by Franklin Paul, David Gregorio and Sanjeev Miglani)