The FBI is investigating a possible black market operation trading stolen driver’s license records, posing risks like national security threats and identity theft. Millions of personal IDs may have been compromised. Federal authorities are actively pursuing this case, as discussed on ‘Special Report.’

Often, you hand out your driver’s license without much thought. For instance, you might rent a car, check into a business, or verify your age. This ID is scanned and returned, often without considering who retains the scan or its storage duration.

A dark web service named Nexus claims to possess over 153 million driver’s license records across the U.S. and Canada. Additionally, Nexus claims access to over 10 million identification cards, more than 3 million travel documents or international IDs, and at least 579,000 medical cards. While large numbers were presented, the 153 million figure comes from Nexus itself and isn’t verifiably the number of unique individuals affected, as some records contain multiple images of the same license.

KrebsOnSecurity reported Nexus’s appearance on a Russian-language forum called Exploit on August 31. It advertised access to identity documents for over 170 million people across North America. Krebs tested Nexus’s service, running a blank search that produced about 11.5 million pages with approximately 15 records per page. Although this doesn’t prove a unique count, it indicates the collection’s massive scale. Additionally, the number of driver’s license records grew by nearly 400,000 within 24 hours during investigation.

The investigation used timestamps from the scanned driver’s licenses to trace potential origins. Cybersecurity journalist Brian Krebs found his own Virginia driver’s license offered by Nexus as a free sample. His record contained six images, including front and back of the license and infrared and ultraviolet versions. Further exploration with friends revealed timestamps nearly matching travel dates and locations of ID presentation.

The investigation leads also pointed to IDScan.net, an identity verification firm with scanners capturing IDs using ultraviolet and infrared light similarly to Nexus records. IDScan.net acknowledged a security breach, admitting that unauthorized parties might have accessed or extracted customer information from its cloud. The data potentially includes driver’s licenses and government-issued IDs.

The FBI confirmed examining the incident, stating it couldn’t provide further details due to the ongoing investigation. KrebsOnSecurity’s publication led to Nexus’s dark web site disappearance. Although the site is gone, previously downloaded or acquired records might still exist.

Your driver’s license contains key personal information that can be used for impersonation by criminals. A high-quality image makes impersonation attempts during identity checks more convincing.

Protective Measures:

• Freeze Your Credit: Prevent new credit accounts with your identity by contacting Equifax, Experian, and TransUnion to place freezes. They are free, don’t affect your score, and are one of the strongest protections against new-account identity theft.
• Monitor Your Credit Reports: Regularly check reports for unfamiliar accounts, inquiries, or information. Stolen information might remain unused for months, so frequent reviews are vital.
• Track Existing Accounts: Since credit freezes don’t cover all types of fraud, ensure alerts are set up with banks and credit card companies, monitor password changes, new devices, and other suspicious actions.
• Secure Email & Phone Accounts: Use strong passwords, enable multifactor authentication, and protect your mobile account with additional security measures to prevent unauthorized transfers.
• Identity Theft Protection Services: Consider utilizing theft protection services that offer monitoring, alerts for personal data involvement in breaches, and guidance for recovery. Analyze service offerings and response times.
• Swift Action for Identity Misuse: If identity theft occurs, document facts and start recovery through IdentityTheft.gov. Contact state motor vehicle agencies if licenses are misused.

Protect yourself by being cautious about handing over your driver’s license, especially considering how its scan could be misused. Stay vigilant about your credit, watch your accounts, and consider identity theft monitoring for added security.