Data Breach Exposes Over 153 Million Identity Documents for Sale
On August 31, a source informed KrebsOnSecurity about a service listed on the Russian cybercrime forum Exploit, which was offering access to digital scans of identity documents belonging to over 170 million individuals in North America. The service, named Nexus, claims to have more than 153 million drivers licenses from the United States and Canada, along with over 10 million identification cards, more than three million travel documents, and at least 579,000 medical cards.
A preliminary search in Nexus, conducted without any specific parameters, yielded approximately 11.5 million pages of results, with around 15 results displayed per page. The majority of the records pertain to American citizens, although there are also significant numbers from Canada. For instance, a search for Canadian drivers licenses alone returned about 1.1 million results, with the highest concentration from Ontario, totaling 473,673 records.
Investigations suggest that the source of this data breach is IDScan.net, a company utilized by car rental agencies such as Hertz and various marijuana dispensaries. This organization reportedly retained over 150 million scans of ID cards and has now lost them due to the breach, raising serious concerns about the security of personal information.
