Renter's driver's license listed for sale on dark web site within hours
A journalist found their driver's license scan for sale on a new dark web marketplace called Nexus just hours after renting a car, part of a listing of roughly 153 million such documents. Researcher Brian Krebs traced the leak to a third-party ID scanning service used by rental firms.
A journalist who recently rented a car discovered that a scan of their driver's license had appeared for sale within hours on a newly launched dark web site called Nexus, which lists roughly 153 million driver's license scans in total.
Possible link to an ID scanning vendor
Security journalist Brian Krebs of KrebsOnSecurity, who first uncovered the site, found that new scans surface for sale in a very short window after people present their IDs at rental companies or other businesses — sometimes within hours. Over just 24 hours, the number of listed licenses grew by nearly 400,000, suggesting the breach is ongoing and that newly harvested cards become available almost immediately. This points to the possibility that whoever runs Nexus has near real-time access to data passing through a third-party ID scanning service used by these businesses.
Using publicly available information, Krebs identified IDScan.net, a New Orleans-based ID scanning company, as having announced an exclusive arrangement with Planet13, and as listing Hertz along with 11 other companies among its clients. IDScan.net said its scanning technology captures documents in both infrared and ultraviolet spectra. Company representatives did not immediately respond to Krebs' emailed questions, though a spokesperson later said IDScan.net is investigating. The rental company involved also did not immediately respond to questions.
A new kind of exposure
The journalist noted that personal details such as addresses, Social Security number, and demographic information had already been exposed in prior breaches, as has happened to millions of other people. What makes this incident more concerning is the reported inclusion of infrared and ultraviolet scan data, which is typically used to verify a document's authenticity.
The Nexus site went offline within hours of Krebs' report, meaning there is currently no way for people to check whether their information was included. The FBI is reportedly investigating the matter.
