153 million U.S. and Canadian ID cards were sold on the dark web
For some time, more than 153 million driver’s licenses belonging to U.S. and Canadian citizens were available for sale on the dark web. Among the stolen documents was the driver’s license of U.S. Secretary of War Pete Hagseth.
A service called Nexus claimed to possess 153 million driver’s licenses, 10 million ID cards, 1.9 million travel documents, 1.3 million international driver’s licenses, 579,000 medical records, 429,000 access cards, 91,000 residence cards, 77,000 work permits, and 5 million other documents. According to the sellers, the data allegedly came from Louisiana’s identity authentication service.
The offer to purchase these documents was advertised on Exploit, a Russian cybercrime forum. The author of the posts posted Krebs’s own driver’s license as a free sample. This is precisely what caught the journalist’s attention. While browsing the database, Krebs was able to see a preview of Pete Hagseth’s driver’s license, as well as documents belonging to several of his friends and relatives, whose data he had searched for with their consent.
Krebs’s investigation confirmed that the service did indeed possess up-to-date data. A common thread among all the document holders found in the database was that they had used Hertz to rent cars.
The journalist also spoke with security researcher Zach Edwards, whose data was also found on Nexus. Edwards said he hadn’t rented a car recently, but had recently used his ID at a Planet13 store.
At the same time, it turned out that neither Hertz nor Planet13 authenticates customers on their own. Both companies use the services of the same contractor, IDScan.
The FBI’s New Orleans field office has launched an official investigation into the data breach. Shortly after Krebs’s report was published, the Nexus website disappeared from the dark web.
This was reported by cybersecurity journalist Brian Krebs.
Previously, hackers attacked three British airports and gained access to passenger data.
As a reminder, foreign governments attempted to hack the messaging accounts of high-ranking European Union officials. This was officially acknowledged for the first time at the level of EU institutions.
Additionally, the Norwegian Agency for Digitalization has been under a large-scale cyberattack for the third consecutive day, which is being called one of the largest in the country in recent months. Cybersecurity experts are working to restore stable system operations and identify the source of the attack.
