The FBI is reportedly investigating a potentially massive breach of identity data that may have swept up the details of as many as 170 million North Americans.

First revealed by investigative journalist Brian Krebs, the “Nexus” service offered access to digital scans of identity documents to users of the Exploit Russian cybercrime forum.

It apparently claimed to have over 153 million driver’s licenses for mainly American as well as Canadian drivers, alongside ID cards, travel documents, medical cards and more.

The operators of Nexus reportedly claimed the trove came from an active breach at “a major identity verification company.”

Read more on identity data breaches: US Data Breaches Hit Record High but Victim Numbers Decline.

Although the Nexus service went dark shortly after Krebs published his post, he managed to track activity from his own and other identified victims’ movements to link the data to New Orleans-based identity verification provider IDScan.net.

The firm said it is currently investigating the matter.

Understanding the Impact

Seemant Sehgal, founder and CEO of BreachLock, said the incident may have far-reaching consequences.

"A license contains the owner's date of birth, address, physical descriptors, and a government-issued ID number. This is enough data to pass identity verification checks that most financial institutions and government agencies still treat as reliable,” he explained.

“The harder problem is that unlike a compromised password, none of those fields can be changed, so every person in this dataset will carry this exposure with them for life. It's good that this isn't being taken lightly, but it may be time to raise the standard for ID verification checks."

Denis Calderone, CTO at Suzu Labs, argued that businesses using identity verification vendors need to ask harder questions about how long scans are retained after verification, if there are contractual data minimization obligations, and whether they can audit said firms.

"Right now there is no infrastructure analogous to a credit freeze that lets someone flag a compromised driver's license number,” he added.

“Every organization collecting and centralizing government-issued identity documents needs to treat those data stores with at least the same security posture they'd apply to payment card data, if not higher. You can get a new credit card number in 24 hours. You can't get a new face."