The FBI is officially investigating claims that a short-lived website called Nexus recently obtained and publicized scans of more than 153 million driver’s licenses belonging to people in the U.S. and Canada.
The trove was briefly for sale on the dark web, according to an investigation by security journalist Brian Krebs, potentially giving identity thieves another powerful tool to impersonate victims — and steal their money.
The 153 million figure comes from Nexus and has not been independently confirmed, but Krebs wrote in a Tuesday blog post that he found licenses belonging to himself, friends, relatives and even U.S. Defense Secretary Pete Hegseth in the database. In several cases, the timestamps on the Nexus images reportedly lined up with times they had handed over their licenses while renting cars or traveling.
Krebs points to Louisiana identity verification company IDScan.net as a possible source of the leak. IDScan.net — which has been used by companies like Hertz and Planet 13 — told KrebsOnSecurity it was investigating but has not confirmed that it suffered a breach. The Nexus website disappeared shortly after the report was published.
When contacted by Money, the FBI’s New Orleans field office confirmed that it is “looking into the incident” but declined to comment further.
How a stolen driver’s license could cost you
The good news is that a digital scan of your driver’s license alone may not be enough for a criminal to steal your identity. The bad news? It’s still possible for scammers to use that data for nefarious purposes.
“They can combine it with other information on the dark web, on data broker sites and social media to create a compelling profile of the individual,” says Ian Bednowitz, general manager of LifeLock.
Criminals can then use that profile to apply for loans or credit cards in your name, impersonate offices like the Department of Motor Vehicles in convincing phishing scams or target relatives with “emergency” demands for cash built around real details about you. Stolen identities can also be used to apply for jobs.
What you can do after the driver’s license leak
There is currently no public tool for determining whether your license appeared in the Nexus database. But there are several steps that can reduce the financial risks of this and other data breaches.
Start by freezing your credit with Equifax, Experian and TransUnion. While credit freezes aren’t foolproof — they won’t stop scams that don’t require a traditional credit check — they are free and prevent others from opening most types of new credit accounts in your name.
You should also regularly review your bank statements, credit card bills and credit reports for activity you don’t recognize (identity theft protection services can monitor these for you). And if you believe your identity has already been compromised, the Federal Trade Commission also recommends placing a fraud alert on your credit report. Fraud alerts tell businesses to take additional steps to verify your identity before issuing new credit.
You can also limit how often copies of your ID end up in companies’ databases in the first place.
Consumers should look for alternatives to providing a driver’s license when possible and, “in general, share as little personal data as possible with third parties,” Bednowitz says. If a business requires an ID scan, like a rental car company or hotel, he recommends checking its privacy terms to find out how the image will be stored and whether you can request that it be deleted afterward.
#Million #Drivers #Licenses #Leak #Protect
About the Author
