FBI investigates dark-web sale of 153 million driver’s license scans

KrebsOnSecurity said it confirmed the authenticity of the cybercriminals’ claim when the group provided a scan of the security researcher’s own driving license; other victims likewise confirmed that their scanned licenses were correct. Along with driver’s licenses, the leaked documents include medical cards, residence cards and related identification records.

Nexus says the license images are the result of a security breach at an identity-verification company, and the source appears to be a Louisiana-based firm. The criminals claim they still have access to the source, a claim supported by the addition of almost 400,000 new scans within the past 24 hours, according to the report.

The report also points to indications that at least some of the data was stolen from a verification service used by rental-car company Hertz. A New Orleans-based company has been identified as a potential source, and its client list includes Hertz, Target, FedEx, Motorola Solutions, Jack Henry and Caesars Entertainment.

In analysis accompanying the report, 9to5Mac called the breach serious and noted the irony of criminals hacking an identity-verification service to obtain documents useful for identity theft. It also cited a recent estimate that online scams cost Americans almost $150 billion last year.