153 Million Driver's Licenses Are for Sale, and This Is Why Centralized ID Verification Worries Me

Brian Krebs reports that the FBI is investigating a new identity-theft service selling scans of more than 153 million driver's licenses from the United States and Canada.

That number is difficult to get my head around. 153 million driver's licenses. Not just names and license numbers—actual images of government-issued identification. Some records include multiple scans of the front and back, including infrared and ultraviolet images used by ID-verification systems to determine whether a document is genuine.

The dark-web service, called Nexus, also claims to have millions of other identity documents. According to the operators, new data is still being stolen. Krebs watched the number of driver's-license records increase by nearly 400,000 in about 24 hours. It looks like an ongoing source.

Krebs found his own Virginia driver's license in the database and followed the timestamps. A pattern emerged: travel—places where people had handed over or scanned their licenses. Krebs and his mother both had records timestamped within seconds of each other after handing their licenses to a Hertz rental-car representative together. Security researcher Zach Edwards had a timestamp corresponding to a Las Vegas trip; one location that definitely scanned his ID was the Planet 13 cannabis dispensary, which publicly announced in 2022 that it uses a Louisiana company called IDScan.net for identity verification.

IDScan.net performs more than 21 million identity verifications every month at more than 20,000 locations, and its scanners can capture exactly the kind of infrared and ultraviolet images showing up in the stolen records. The FBI's New Orleans field office has opened an investigation into an apparent breach involving IDScan.net. That does not yet mean the company has been confirmed as the source.

This is what makes identity-document breaches particularly ugly. If somebody steals my password, I change it. If they steal a credit-card number, the bank issues another one. A driver's license contains information that is considerably harder to rotate—and in this case, potentially high-quality images of security features intended to prove the document itself is authentic. Those images are useful precisely because businesses increasingly rely on driver's licenses as proof of identity. Now criminals may be able to purchase copies of the thing those systems trust. That is a pretty serious inversion of the security model.

This is also exactly why I get uncomfortable every time another law or company decides that the solution to some problem is: Upload your driver's license. Age verification, hotel check-in, car rentals, cannabis dispensaries, account recovery. Every one of those interactions can create another copy of one of the most valuable identity documents I have. Often I have no idea where that image actually goes. Compromise one vendor and you may gain access to identity documents collected by thousands of customers.

We keep calling these systems "identity verification." They are also identity-document aggregation systems, and that second description deserves much more attention. The consequence of failure grows with the trust we concentrate there, and 153 million driver's licenses is an extraordinary concentration of trust.

Shortly after Krebs published, the Nexus marketplace disappeared. Its login page was replaced with:

"This service is no longer available."

That is good news if the service actually stays gone. Shutting down the marketplace does not close whatever hole allowed the data to leave.

Businesses ask for driver's licenses remarkably casually. Scan this. Upload that. Photograph both sides. We'll keep it on file. Trust us. But these documents are reusable credentials for a person's physical identity. If a company does not absolutely need to retain the image, it probably shouldn't. If it only needs to know that someone is over 21, it should store over_21: true—not a permanent photograph of that person's driver's license.

Hopefully the FBI finds where these 153 million records came from. Even if they do, we should ask why so many copies needed to exist in one place in the first place.

Read Brian Krebs' full investigation, FBI Probes Service Selling 153M Driver's Licenses.