Louisiana Voice

A Russian cybercrime forum called Exploit is selling digital scans of more than 153 million drivers licenses of residents of the U.S. and Canada by siphoning images collected by a Louisiana-based identity verification company, according to former Washington Post reporter-turned security news and investigation reporter BRIAN KREBS.

Krebs said the New Orleans FBI field office has launched an official inquiry into the source of the images being offered on the dark web. He identified the New Orleans company, idscan.net, which purportedly performs more than 21 million ID verifications monthly at more than 20,000 locations worldwide.

Jillian Kossman, marketing and operations leader at idscan.net, said, “At this point, I’m not able to share any additional information.”

The service, Nexus, claims to have more than 152 million driver’s licenses and another 10 million identification cards, three million travel documents and more than half-a-million medical cards of residents of the U.S. and Canada. Other records carry a source notation of CAC, which could refer to Common Access Cards, which are government-issued identity cards that grant physical access to government buildings and secure rooms.

Krebs said those behind Nexus claim the license images are coming from an active breach at “a major identity verification company” whose customers include multiple Fortune 500 companies.

Over the past 24 hours alone, Krebs wrote, “the number of driver’s license records listed as available in Nexus has increased by nearly 400,000, suggesting that freshly stolen license data is being harvested and uploaded to this service on a semi-regular basis.”