FBI probes report of data breach exposing millions of drivers’ licences in US, Canada

• The FBI is investigating a report that tens of millions of US and Canadian drivers' licences are being sold on the dark web, risking identity theft and fraud.
• Journalist Brian Krebs confirmed the data's authenticity and revealed the dark web site Nexus was updating stolen licence data in real time.
• Cybersecurity experts called the breach unprecedented in scale, creating national security risks, but the source of the stolen data remains unknown.

WASHINGTON – The FBI said on Sept 2 it was investigating a report that tens of millions of drivers’ licences belonging to people in the United States and Canada were being sold on the dark web.

On Sept 1, the independent journalist Brian Krebs said he had discovered a dark web site selling digital scans of millions of drivers’ licences from people in the US and Canada. He said he confirmed the authenticity of the data being sold with nine people.

In a brief statement on Sept 2, the bureau said it was “looking into the incident” but could not comment “due to the ongoing nature of the investigation”.

The breach, if confirmed, could be one of the largest-ever exposures of government-issued identity documents in North America, creating risks of identity theft and fraud for tens of millions of people.

Krebs said he was alerted to the site after it was advertised on a Russian cybercrime forum, with his own driver’s licence being offered as a free sample.

He said the service, dubbed Nexus, claimed to have tens of millions of licences for people in the US and Canada, as well as millions of other identification cards and travel documents and hundreds of thousands of medical records.

Krebs said that the site appeared to be updating its database of stolen data in real time, indicating that it was being fed by a live breach.

Zach Edwards, a threat researcher at the cybersecurity company Infoblox, said the incident was unprecedented in terms of its sweep.

“There’s never been a breach of driver’s licences at this scale,” said Edwards, who added that his own licence was available for sale on the site.

Edwards said that the ongoing nature of the breach “means that this attack created legitimate national security risks for high-profile individuals”.

Reuters could not establish the source of the stolen data. Krebs quoted a representative of New Orleans-based identity verification provider IDScan.net as saying that it was investigating the matter.

IDScan.net, which describes itself as providing “ID fraud prevention at scale”, did not return repeated messages from Reuters.

Krebs said the dark web site offering the driver’s licence data vanished shortly after he published his report. REUTERS