More than 150 million driver’s license scans were up for purchase on the dark web, highlighting the risk you take every time you hand over your physical ID.
Recently, a dark web platform known as Nexus claimed to be selling more than 153 million driver’s license scans. In addition to the driver’s licenses, there were more than 10 million ID cards, 3 million travel documents and international IDs, and over 579,000 medical cards.
KrebsOnSecurity was alerted to the existence of the dark web site on August 31. Upon visiting the site, KrebsOnSecurity found the 153 million figure plausible; a blank search in Nexus returned 11.5 million pages of results, with 15 results per page.
Most of the scans were of U.S. licenses, but more than one million Canadian licenses were also included in the search results.
It wasn’t limited to standard IDs, either. It also included CDLs, or commercial driver’s licenses, and CACs, or Common Access Cards, cards that are used to grant physical access to government buildings and secure rooms.
KrebsOnSecurity found that Pete Hegseth, United States Secretary of War, had his license made available on Nexus
According to Nexus, it had been extracting data for over a year from “a major identity verification company.” Researchers were able to find their own data, as well as data of relatives and those who wished to participate in the investigation.
KrebsOnSecurity noted that many of those found in databases had rented a car through Hertz. Timestamps on the Nexus listings often coincided with the date that these rentals occurred.
Since then, Nexus has been removed from the dark web. But it doesn’t mean that the data has vanished, and it also doesn’t mean that this can’t happen again in the future.
The rise of the Digital ID
If you’re one of the lucky few who live in a state that allows you to link your ID to your iPhone, you might be thinking that you’re sheltered from this sort of thing. Or, at the very least, you might hope you are.
The answer is a soft “well, maybe.”
It is true that digital IDs such as driver’s licenses in Apple Wallet could reduce the amount of identity data businesses collect and retain. Apple notes that the beauty of digital IDs is that they could selectively share your information with a business requesting ID verification.
For example, say you wanted to head down to your local grocery store and buy a six-pack of beer. Then, at the register, your iPhone could provide the ID reader with your date of birth, but not your address or driver’s license number.
Selective information sharing can help prevent data leaks
But that assumes your grocery store is using a reader that accepts digital IDs, which, odds are, it probably isn’t. And there’s a good chance you live in one of the 33 U.S. states that doesn’t support ID in Wallet at this time.
And let’s not forget that digital IDs are only accepted in some cases, like certain TSA checkpoints. You’re still going to have those times when someone is going to require your physical ID.
Even Apple has been explicitly clear on this fact.
Adoption is far from universal, and I am not entirely sure if we’ll ever get to the point where it is truly universal. Apple launched Apple Pay in October 2014 but adoption didn’t really take off until early 2019, when it was finally accepted at 65% of all retail locations in the US.
So expecting wide adoption of ID verification to happen on any timescale that isn’t glacial at best is a bit of a pipe dream.
Of course, I’m putting the cart before the horse here, too.
I would like to point out that there’s no evidence that any digital ID verification would have solved this problem. This is largely because we’re unsure where the data came from in the first place.
KrebsOnSecurity suggests that, currently, the running theory is that the data could have come from IDScan.net, a third-party ID verification firm. Interestingly, Hertz is listed as a known partner for IDScan.net.
A small collection of brands that use IDScan.net’s ID scanning | Image credit: IDScan.net
And yes, IDScan does provide physical, in-person hardware for scanning ID. But perhaps more concerningly, they also provide developer SDKs and mobile app integrations.
If you’ve ever needed to take a picture of your ID to verify your age to use an app, it’s possibly been routed through IDScan.net’s databases. DraftKings and eSign, for example, use IDScan.net’s app integrations.
And while, theoretically, Verify with Wallet API does exist, Apple severely limits what services can use it. Gambling apps, notably, are not allowed.
As of early Wednesday, IDScan.net hasn’t made a public announcement on whether or not there has been a data breach at this time. However, the FBI has launched an investigation into the service.
