Rented a car recently? A scan of your driving licence may have been up for sale

On 31 August a service calling itself Nexus went live on a Russian cybercrime forum, offering something a good deal worse than a password dump. Brian Krebs, who wrote it up on 1 September, counted more than 153 million US and Canadian driving licences, over 10 million ID cards, 3 million travel documents and 579,000 medical cards. Front and back images, and in some cases the infrared and ultraviolet scans as well. Nexus claimed it had been quietly pulling fresh records out of a "major identity verification company" for over a year, and said it had added 400,000 in the previous 24 hours.

The company in question appears to be IDScan.net, a Louisiana firm whose scanners sit behind counters at car rental desks, hotels, bars, gun shops and dispensaries. Hertz is a customer. Nexus went dark on 2 September, a day after Krebs published, which is not at all the same thing as the data being gone. By 4 September the FBI's New Orleans field office had opened an investigation, several lawsuits had been filed in Louisiana, and IDScan had still said nothing publicly.

Here is the uncomfortable part. A licence is not a password. You cannot rotate your date of birth, and a clean high-resolution image of a real document is exactly what someone needs to open an account in your name or talk their way past a support desk. Freezing your credit is the single most useful thing you can do, and it is free. After that, treat any call or email that recites your licence number as evidence of nothing at all. That detail is no longer private.

Most of us keep our own copies too, the passport photo for a booking, the licence scan the insurer wanted, sitting in a folder on the PC. Tendvane's security posture check will tell you whether the drive holding them is actually encrypted with BitLocker, which is not the same as assuming it is.