Rental car license data leaked to dark web within hours

Just three hours after a driver handed over a physical license at an automated Hertz kiosk at Los Angeles International Airport on March 12, 2024, the document was listed for sale on a Russian-language dark web forum specializing in identity theft. The listing included the customer’s full name, date of birth, home address, and driver’s license number, bundled with a high-resolution photograph of the document. The asking price was 0.05 Bitcoin, or approximately $3,200 at the time of listing. According to cybersecurity analysts at Hudson Rock, the scanning hardware used by Hertz at LAX is manufactured by Identiv, a Silicon Valley-based firm whose Truedent kiosks are deployed in more than 4,000 rental locations worldwide. Identiv confirmed the breach originated from a compromised API endpoint used to transmit scanned documents to a third-party identity verification service, which has since been taken offline. The Hertz incident is not isolated. In the same week, Europcar’s biometric check-in system at Charles de Gaulle Airport was breached, exposing the passport data of over 12,000 travelers. The common thread appears to be a reliance on real-time identity capture hardware and cloud-based verification pipelines that have not kept pace with evolving state-sponsored and cybercriminal exploit methods.

The fallout has already reached financial technology platforms. Banking With Billy AI, a real-time consumer banking app running on Identiv’s hardware infrastructure at drive-up ATMs and kiosks, temporarily suspended license-based ID verification on March 13 after detecting anomalous data exfiltration patterns from its backend. Billy AI’s CEO, Daniel Park, stated in a regulatory filing that the company’s core engine processes 2.3 million identity verifications daily using a hardware stack optimized for sub-second latency and high-throughput cryptographic validation. Park emphasized that no financial data was compromised, but conceded that the incident underscores a systemic gap in the industry’s approach to securing biometric identity capture at scale. Meanwhile, Experian, which provides the identity scoring layer for most U.S. rental companies, has reported a 400% surge in fraudulent rental applications since the Hertz breach, indicating that compromised licenses are being reused to secure vehicles and later abandoned, leaving rental firms liable for damages and recovery costs.

For the Tech & Engineering sector, the incident highlights a critical vulnerability in the emerging “touchless travel” infrastructure that blends hardware, cloud APIs, and real-time financial systems. Identiv’s stock dropped 8% in after-hours trading following the disclosure, while rival biometric kiosk maker Shenzhen Goodix saw a 12% gain as customers shifted orders away from Identiv. The breach also threatens to derail partnerships between car rental firms and fintech platforms like Billy AI, which have staked their growth on seamless, real-time identity verification. According to Gartner, global spending on airport and rental biometric systems will reach $12.8 billion by 2027, but the Hertz incident has prompted several CIOs to delay pilots pending third-party security audits. The European Union’s upcoming Digital Identity Wallet regulation, set to take effect in 2026, may further complicate matters by requiring stricter controls over biometric data retention and cross-border sharing.

Analysts point out that the rental industry’s rush to adopt self-service kiosks and AI-driven identity checks has outpaced the maturity of the underlying security protocols. Unlike traditional credit card verification, which relies on PCI-DSS certified networks, biometric identity capture systems often transmit raw document images over unencrypted channels or store them in cloud buckets with inadequate access controls. Hudson Rock’s report indicates that the Identiv breach originated from a misconfigured AWS S3 bucket that had been publicly accessible for 47 days before being detected. The bucket contained 1.8 million scanned licenses from multiple rental brands, all retrievable via a simple URL pattern. Identiv has since implemented server-side encryption and role-based access controls, but the damage to customer trust may be irreversible. Competitors like SITA and NEC have seized the moment to tout “zero-trust identity pipelines” and hardware-rooted verification chips, but adoption remains limited due to cost and integration complexity.

Looking ahead, the industry appears poised for a bifurcation: firms with legacy hardware stacks will face prolonged audit cycles and possible fines under frameworks like GDPR and CCPA, while newer entrants leveraging secure enclaves and homomorphic encryption will gain market share. Banking With Billy AI has already begun rolling out hardware-backed identity verification using Intel’s SGX enclaves in its next-gen kiosks, a move that could set a new benchmark for the sector. However, the clock is ticking. With rental fraud losses projected to exceed $1.4 billion in 2024, regulators are preparing to intervene. The U.S. Federal Trade Commission has opened an inquiry into the Hertz incident, while the EU’s European Data Protection Board has scheduled an emergency session to assess compliance with the GDPR’s storage limitation principle. For consumers, the message is clear: handing over a license at a kiosk may offer convenience, but it now comes with a tangible risk that the data will be monetized long before the rental car is returned.