Brian Krebs found his own driver's license for sale on a Russian crime forum this week. The timestamp on the scan matched the day he rented a car to attend a family funeral. His mom's license was there too, scanned a few seconds after his.

The service is called Nexus. It claims over 153 million driver's licenses from the US and Canada, and the count grew by nearly 400,000 in a single day. Krebs traced the scans back to an identity verification vendor that checks IDs for rental car companies, big retailers, and over 1,000 marijuana dispensaries. The FBI opened an investigation on Tuesday.

Most of the people in that database never dealt with the vendor. They handed a license to a clerk at a counter. The clerk ran it through a scanner. Nobody mentioned that the scanner belonged to a different company, or that a copy might stick around long enough to get stolen. If your company scans customer IDs, you own the risk of how your vendor uses those images, whether the contract says so or not.

Two things worth thinking about:

- Every new "show us your ID" rule, including the ones sold as protecting kids online, pushes more license scans into more vendors. Each one is another place to lose them.

- A driver's license is still what banks use to open credit. A scan with the photo, front and back, in infrared and ultraviolet, is close to a master key.

I would love to see ID scans deleted the moment a check is done. Until then, ask whether your license will be scanned or just looked at before you hand it over. And freeze your credit at all three bureaus. It's free. It takes about ten minutes.

https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/

#Cybersecurity #Privacy #IdentityTheft #security #privacy #cloud #infosec