FBI Investigates Possible Breach of Millions of American IDs

The FBI is investigating a possible breach that may have exposed scans of millions of American drivers’ licenses, according to Bloomberg News. A bureau spokesperson confirmed the investigation on Thursday. The news lands as identity verification companies face growing pressure to protect the documents they collect. This raises fresh concerns about how easily stolen IDs can fuel fraud across banking and payments.

According to Bloomberg, criminals are selling access to more than 160 million “North American” drivers’ licenses through a service called Nexus. The listing appeared on Exploit, a Russian-language cybercrime forum, and referenced “160M+ USA DL/ID Scans + data.” The sellers also claim to have more than 10 million other documents, including residency cards, medical cards and international identity documents. Bloomberg reports that the source of the stolen data isn’t clear.

The advertisement for the stolen data read: “We are offering access to our proprietary and exclusive database of breached identity documents. We have persistent access to a major identity verification company and its customers, which includes multiple Fortune-500 companies.”

Bloomberg reports that cyber threat researcher Zach Edwards, whose own identification turned up in the cache, said the breach could rank among the biggest leaks of US government identity documents ever if confirmed. Edwards, who works for the cybersecurity firm Infoblox, told Bloomberg the attack looks like an ongoing operation, with new credentials still being submitted and stolen. He said this creates real national security risks for high-profile individuals.

Independent journalist Brian Krebs first reported the breach and confirmed the authenticity of some documents with nine people whose licenses were listed for sale. The Nexus service went offline soon after news of the FBI investigation broke. An FBI spokesperson told Bloomberg the bureau is looking into the incident. It declined further comment given the ongoing investigation.

This breach fits a troubling pattern PYMNTS has tracked this year. PYMNTS reported that stolen driver’s license data from a similar cache could supercharge enterprise fraud, since authentic stolen documents make it harder for banks to verify who they are really dealing with. PYMNTS also covered how Wisconsin officials revealed the Conduent breach affected 25 million Americans, exposing Social Security numbers and health data tied to government benefit programs. And PYMNTS reported that Citizens Bank and Frost Bank disclosed a third-party breach tied to the Everest ransomware gang, a reminder that vendor risk now sits at the center of financial data security.

The post FBI Investigates Possible Breach of Millions of American IDs appeared first on PYMNTS.com.