Brian Krebs remembers the moment clearly enough. He and his mother stood at a Hertz counter, handed over their driver's licenses, and waited while a clerk disappeared behind the desk with them for a few minutes to process the paperwork. It's the kind of moment nobody thinks twice about.
Krebs, a longtime security researcher, didn't think twice about it either, until he found his own license, and his mother's, sitting in a dark web marketplace with timestamps a few seconds apart, matching almost to the second when they'd handed those licenses across the counter.
That's how Krebs traced the origin of what may be the largest single exposure of government-issued identification in U.S. history: more than 153 million driver's licenses from the United States and Canada, plus over 10 million ID cards, three million passports and travel documents, and more than half a million medical cards, all listed for sale on a dark web service called Nexus. The FBI's New Orleans field office confirmed it opened an investigation into an apparent breach at idscan.net, a Louisiana-based identity verification company whose scanning technology, according to its own marketing materials, processes more than 21 million ID checks a month at over 20,000 locations.
More Info