Driver's Licenses Sold on Dark Web After Rental

A driver's license, scanned by an employee of a well-known car rental company, was found for sale on the dark web within hours of the rental transaction. This incident, detailed in an exposé published Tuesday by KrebsOnSecurity, revealed that the license was among more than 153 million available through a new ID theft service named Nexus. The service offered high-resolution scans of driver's licenses, including multiple image files that captured the front and back of the IDs. These files reportedly included not only basic image scans but also representations in the infrared and ultraviolet spectrums. The inclusion of these specialized formats is presumed to aid in the creation of counterfeit IDs that can bypass hologram tests, a common security measure for authentic documents. The availability of driver's licenses was not the sole offering of Nexus; the service also advertised and sold a variety of other identification documents. The exposé by KrebsOnSecurity, a cybersecurity news outlet known for its in-depth investigations into online threats, highlighted the rapid proliferation and accessibility of stolen personal identification information. The report indicated that licenses belonging to prominent individuals, including journalist Brian Krebs himself, his mother, an FBI assistant director, and several security researchers, were also listed on the platform. This suggests a broad reach and significant compromise of personal data. The Nexus service's ability to quickly list a newly scanned ID for sale points to potential vulnerabilities in the data handling practices of entities that collect such sensitive information, like car rental agencies. The implication is that the data was not adequately secured after the initial scan, allowing it to be exfiltrated and offered on the illicit market. The existence of Nexus and its extensive catalog of stolen identities underscores the persistent and evolving threat of identity theft and the challenges faced by individuals and organizations in protecting personal data from cybercriminals. The ability to purchase not just basic scans but also specialized spectral images of identification documents represents an escalation in the sophistication of tools available to those seeking to create fraudulent identities for various illicit purposes, including financial fraud, impersonation, and other criminal activities. The report serves as a stark warning about the potential consequences of data breaches and the critical need for robust security measures across all sectors that handle personal identification information.