Bill Hinton/Getty Images
Over 153 million driver’s licenses, medical cards, and travel documents from victims in the United States and Canada recently ended up on the dark web, available to purchase through a service called Nexus. The company claimed the scanned documents were obtained through an identity verification company breach. Companies collecting scans of identifying documents– which often include things like an individual’s full name, ID number, and address — is fairly commonplace these days.
The Federal Bureau of Investigation (FBI) is aware and investigating. Meanwhile, investigative reporter and security expert Brian Krebs was alerted to the leak, which included his own driver’s license and those of his friends and family. Since then, he has been trying to figure out how the driver’s licenses were obtained, narrowing in on IDScan.net, which is an identity verification company used by big brands like Hertz, Target, and FedEx, as well as local marijuana dispensaries and retail, transportation, and finance businesses. It’s currently used in over 20,000 locations around the world.
“These systems are putting sensitive data into more and more 3rd party vendors, and we don’t have nearly the oversight to ensure they are safe,” security researcher Zach Edwards stated (via KrebsOnSecurity). A spokesperson for IDScan.net told Krebs that there was an active investigation into the breach. As the scrutiny continued, Nexus removed its driver’s license service from the dark web.
What can you do to protect yourself from identity theft?
Deemerwha studio/Shutterstock
It can be alarming to learn that your driver’s license is out there on seedier parts of the web, especially with data breaches and leaked personal information becoming quite common. Thousands of data breaches occur every single year. However, Krebs believes it’s hard to avoid identity theft situations at this large of a scale. “There is no way to ‘protect’ yourself from someone else using a digital scan of your license if the company collecting the scans is relieved of them by hackers, apart from choosing not to have your ID scanned by anything or anyone,” Brian Krebs stated to TIME.
All you can really do, other than refusing any ID scans as Krebs suggests, is make your information tougher to find. Store important documents in a secure place and don’t share sensitive personal information over the internet, including email. Keep an eye out for phishing attacks and avoid malicious software. Keep your passwords varied and secure. If this wasn’t enough and someone has your personal information, freeze your credit and contact the Federal Trade Commission (FTC) to formulate a plan of action to protect yourself.