Nexus ID Breach Exposes a Blueprint for Fraud, Experts Warn

The dark-web marketplace surfaced successful precocious August, claiming entree to astir 170 cardinal records, including much than 153 cardinal U.S. and Canadian driver’s licenses, 10 cardinal different IDs, 3 cardinal question documents, and astatine slightest 579,000 aesculapian cards. Its operators claimed the accusation had been siphoned for much than a twelvemonth from a large individuality verification company.

Nexus Leak Goes Far Beyond a Password Dump

A password breach is ugly, but determination is usually an flight hatch: Change the password. Government recognition is simply a antithetic beast. Dr. Marilyne Ordekian noted that driver’s licenses incorporate accusation that follows radical for years, if not forever, including their photograph, location code and day of birth.

“With breaches leaking passwords, 1 tin reset their credentials and determination on,” Ordekian said. With stolen authorities IDs, she explained, the accusation is efficaciously baked into a person’s individuality and cannot simply beryllium reset aft criminals get their hands connected it.

What makes Nexus peculiarly alarming is the reported beingness of infrared and ultraviolet scans. Ordekian explained that these scans are “a information measurement utilized to verify authenticity,” meaning they are utilized “to authenticate a carnal papers arsenic genuine.” She warned that criminals perchance person “not conscionable your ID, but besides person the blueprint and the method furniture utilized to beryllium your ID is genuine.”

That opens up a large woody of trouble. “Every ID-gated system, beryllium it opening a slope account, a cryptocurrency speech account, renting a car, verifying a ligament transportation etc (anything that relies connected this benignant of ID for individuality verification) is present a imaginable onslaught aboveground which tin beryllium exploited,” Ordekian said.

Stolen Security Features Raise the Stakes for Fraud

Once those records scope transgression markets, individuality theft is lone the starting point. Stolen credentials could perchance beryllium recycled for impersonation, fraudulent slope accounts, wealth laundering, and different schemes. Ordekian warned that the infrared and ultraviolet worldly could marque fraudulent usage harder for verification systems to observe due to the fact that the underlying documents themselves are real.

There is besides a physical-security angle. “We’ve been seeing wrong the cryptocurrency space, for example, however immoderate users and victims of information breaches are being identified arsenic investors and being targeted physically to springiness retired their assets,” Ordekian stressed. “In this concern here, it tin besides endanger home unit survivors and radical successful witnesser extortion programmes.”

The Nexus way has pointed toward New Orleans-based individuality verification supplier IDScan.net, which says it processes much than 21 cardinal individuality checks per period crossed much than 20,000 locations. IDScan has not formally confirmed that it was breached, but the institution told customers it was investigating accusation suggesting information whitethorn person been exposed and that the institution “may beryllium implicated.”

Nexus Puts the KYC Data Honeypot Under the Microscope

The occurrence besides raises an uncomfortable question for know-your-customer, oregon KYC, systems: Does collecting monolithic repositories of individuality documents make a honeypot that becomes irresistible to criminals?

Artem Popov, caput of fraud prevention products astatine Sumsub, said the information is broader than KYC providers alone. “Storing idiosyncratic information anyplace carries risk, and that’s existent for immoderate concern handling it, not conscionable KYC providers,” Popov told Bitcoin.com News. He said radical should efficaciously presume a papers photograph is exposed erstwhile shared online due to the fact that it tin walk done galore services beyond their control.

Popov besides cautioned that stolen documents are only 1 portion of the fraud machine. “A batch of these leaks besides travel down to societal engineering, wherever idiosyncratic is simply convinced to manus their information over, which is precisely wherefore a papers photograph unsocial should ne'er beryllium capable to onboard anyone,” Popov said.

Experts Push Identity Checks Beyond the Document

The adjacent step, Popov said, is adding different layer. “In the aforesaid mode a password isn’t capable to log into thing delicate anymore, a papers needs a 2nd origin down it, similar liveness detection, to corroborate it really belongs to the idiosyncratic presenting it.” Liveness detection mostly asks a idiosyncratic to beryllium that a existent idiosyncratic is physically contiguous alternatively than idiosyncratic simply submitting a stolen photograph oregon document.

Simply replacing IDs with biometric information is not a metallic slug either. Popov warned that biometrics present their ain imperishable hazard due to the fact that a look oregon different biologic identifier cannot beryllium reissued erstwhile compromised. Ordekian, meanwhile, said the occurrence should unit a deeper introspection of individuality verification information rules and however those protections are enforced.

The FBI probe remains open, according to Krebs connected Security, projected people actions person already been filed, and IDScan has yet to people a afloat forensic account, leaving the manufacture not retired of the woods yet arsenic investigators enactment to find precisely what happened and however acold the vulnerability reaches.