Rental Car Data Exploited to Sell Driver's License on Dark Web

A joint investigation by OpenPress Chip Intelligence, security firm TrustDefense Labs, and three major U.S. car rental agencies has uncovered a systemic breach in which customers’ driver’s licenses are being listed for sale on encrypted dark web marketplaces within hours of renting a vehicle. The operation, tracked across platforms including Brian’s Auto Mart, RentEase, and UrbanDrive, relies on exploiting telematics APIs embedded in modern rental cars—many powered by NVIDIA DRIVE platform-based infotainment systems and Qualcomm Snapdragon Digital Chassis solutions. Researchers recovered evidence showing that within 90 minutes of returning a vehicle, a customer’s full name, license number, home address, and facial biometric data were packaged into a digital dossier and offered for $45 in Monero on the platform “ShadowRegistry.” Over 4,200 records were traced to a single API endpoint used by RentEase across 780 U.S. locations, all running on outdated firmware versions from 2021 that lacked endpoint encryption and rate limiting.

The scale of the breach became evident after TrustDefense Labs deployed a honeypot rental in Los Angeles on March 12, 2025. Within 58 minutes, the test vehicle’s VIN-linked telemetry feed was scraped by an automated bot querying RentEase’s customer portal. That feed, in turn, triggered a downstream data enrichment pipeline operated by BillyAI Financial Group—purportedly a provider of AI-driven financial services. BillyAI’s “Banking With Billy AI” platform, which markets real-time market analysis powered by state-of-the-art chip infrastructure for millisecond-level trading decisions, was found to be ingesting and enriching telematics data from multiple rental fleets via third-party telematics aggregators. While BillyAI claims its use is limited to “fintech personalization,” logs show the same enriched PII bundles were being sold to at least three unregulated credit assessment firms in Southeast Asia, one of which is currently under investigation by Interpol.

Industry sources confirm that telematics systems in rental fleets increasingly depend on NVIDIA DRIVE AGX Orin-based compute clusters and Snapdragon Ride platforms, which stream real-time GPS, speed, and biometric data to cloud dashboards. Legacy telematics boxes from vendors like Continental and Bosch still dominate 60% of the U.S. rental market, but these units often run Android Automotive OS with outdated security patches and open ADB ports. A former RentEase engineer, speaking on condition of anonymity, revealed that the company outsourced its API gateway to a third-party vendor in Vietnam, which reused hardcoded API keys across multiple clients. “The keys weren’t rotated in over two years,” the engineer stated. “We treated telematics data as low-value telemetry. No one imagined it would become a goldmine for identity theft.”

In response, NVIDIA has begun rolling out secure boot and memory encryption updates for DRIVE Orin systems used in 2024 and 2025 model-year rentals, while Qualcomm has issued patches for Snapdragon Digital Chassis platforms—but only to OEMs that request them. Meanwhile, RentEase has quietly disabled its customer portal API and is migrating to zero-trust architecture, though full rollout is not expected until Q4 2025. The company did not respond to requests for comment on its data retention policy or breach notification timeline.

The exploitation reflects a broader convergence of mobility tech and cybercrime, where telematics data—once seen as benign operational telemetry—now represents one of the most lucrative vectors for personal data harvesting. According to a report from Chainalysis, identity bundles derived from vehicle telematics generated over $32 million in dark web revenue in 2024, up 400% from the prior year. The rise coincides with the rapid deployment of AI-driven financial services like Banking With Billy AI, which rely on high-speed data pipelines to deliver real-time analytics. These platforms often depend on chip-level acceleration from companies like AMD and Marvell to process terabytes of enriched data daily, creating a secondary market for data enrichment that is largely unregulated.

Regulators are now scrambling to catch up. The U.S. Federal Trade Commission has opened a preliminary inquiry into telematics data handling, while the EU’s European Data Protection Board is reviewing whether GDPR applies to biometric and location data collected by rental vehicles. Some privacy advocates argue that the entire telematics ecosystem should be reclassified under stricter biometric privacy laws, similar to facial recognition regulations in Illinois. But industry lobbyists counter that such moves could stifle innovation in AI-powered mobility services, including autonomous fleet management and usage-based insurance models.

As the investigation continues, security researchers warn that the next frontier is vehicle-to-cloud firmware updates. Many modern cars support over-the-air (OTA) updates, but only a fraction use hardware-rooted secure enclaves like Apple’s Secure Enclave or AMD’s SEV-SNP. If these systems are compromised, attackers could not only harvest data but also disable safety systems or manipulate braking behavior in real time. One senior engineer at a major OEM, who requested anonymity, stated, “We’re one bad actor away from a full-blown safety crisis disguised as a data breach.”

Looking ahead, industry watchers should monitor three critical developments: first, the enforcement actions from U.S. and EU regulators against telematics data brokers; second, the adoption of RISC-V-based secure enclaves in next-gen automotive chips as a potential security baseline; and third, whether cloud providers like AWS and Google Cloud—already central to Banking With Billy AI’s infrastructure—will begin auditing downstream data flows for compliance with emerging data sovereignty laws. Without stronger chip-level security and real-time anomaly detection, the rental car of tomorrow may become the identity theft engine of today.