FBI investigates alleged breach of US IDs after hackers claim Hegseth driver’s license
The FBI is investigating a massive alleged cybersecurity breach of an ID verification company that’s potentially exposed millions of scans of Americans’ driver’s licenses, including Department of War Secretary Pete Hegseth, which cybercriminals have advertised for sale.
Read more How Gloria Steinem’s Ms. magazine became the voice of the women’s movement
The incident appears to be an escalation in how cybercriminals are leveraging the increasing amounts of data Americans are asked to provide companies, as this is the first time a breach of such wide magnitude has seemingly hit an ID verification service.
Researchers at two companies, Infoblox and Flashpoint, that monitor the cybercriminal underground, showed NBC News screengrabs and text from a post on a forum popular with Russian hackers that on Sunday advertised access to a dark web database called Nexus that contained more than 160 million North American driver’s licenses and ID cards. NBC News was unable to access Nexus, which has been down since at least Wednesday.
“We have persistent access to a major identity verification company and its customers, which include multiple fortunte-500 companies. We have been continuously exfiltrating new data for over a year into our private database,” the post said.
“The FBI can confirm that it is looking into the incident. Due to the ongoing nature of the investigation, we decline to comment further,” an FBI spokesperson said when asked about the posts.
In one sample screengrab seen by NBC News, a post on the cybercrime forum advertised a scan of a driver’s license belonging to independent journalist Brian Krebs, who publishes investigations into the cybercriminal underworld and is a frequent target for criminal hackers.
Krebs, who was first to report on the breach, found and published an entry for Hegseth, including an alleged copy of a Minnesota Driver’s license with his name and photo.
A Pentagon spokesperson said in an email that “The Department is aware of these reports and is evaluating them.”
Read more OpenAI releases new model that it says triggered internal security measures
Krebs also wrote that the entry for his own license included time stamps that largely correlated with dates he had traveled, and his reporting led him to a company called IDScan.net, a fraud prevention company that helps customers scan driver’s licenses to verify if they’re authentic.
Neither IDScan nor its CEO, Terry Slattery, responded to requests for comment, but the company has told some of its customers that they were not affected. Spokespeople from Caesars Entertainment, the financial technology company Jack Henry and the real estate tech company MRI Software all told NBC News that IDScan had told them their customers’ data was not stolen. None of those companies were willing to share IDScan’s full statement or clarify whether the company admitted to a breach.
Harry Oppenheimer, a Georgia Tech professor who studies identity verification, said that while U.S. law offers very little digital privacy protections, state and federal governments often require companies to verify Americans’ ages. That has led to an ID verification industry that widely scans people’s documents but doesn’t always put significant effort into protecting them.
“We’ve kind of found ourselves in a situation now where we’re asking more and more information to be verified, which requires more and more of your data traveling around the internet across third parties, but without the sort of safeguards and protections that I think most of us would hope exist,” he said.
Zack Edwards, a threat researcher at Infoblox, said he found it disappointing for any company whose business is holding sensitive documentation for so many people did not do a better job of protecting that information.
“It’s somewhat shocking and disappointing that a serious corporate organization like this didn’t have protective DNS solutions or any way to monitor real-time data going from their systems into an unexpected location,” he said.
Read more Arrest warrant issued for ‘Below Deck Mediterranean’ star Nathan Gallagher
