Reported data may include UV and infrared scans of documents
The dark web marketplace Nexus claims to have access to around 170 million records, including more than 153 million US and Canadian driver’s licences. The claim includes 10 million other identity documents, 3 million travel documents and at least 579,000 health cards.
Cybersecurity researcher Marilyne Ordekian said the reported material includes photographs, addresses, dates of birth, and infrared and ultraviolet scans. According to Ordekian, such scans are used to verify the authenticity of a physical document and could increase fraud risks for services that use documents for identity verification.
Artem Popov, head of fraud prevention products at Sumsub, said a photograph of a document should not be the only element used for onboarding. He identified liveness detection as an additional factor to confirm that the person is physically present. Popov added that biometric data carry permanent risks because they cannot be reissued after a compromise.
The incident has been linked to IDScan.net, which told customers it was investigating information suggesting that data may have been exposed and that the company may be involved.
