Rental car data exposed: Driver’s licenses sold within hours

On April 3rd, 2025, a private individual in Miami, Florida, rented a midsize sedan through a global rental network whose core platform uses NVIDIA DRIVE-based telematics to log driver identity, location, and biometric signatures at 10-second intervals. Within 3 hours and 17 minutes of signing the rental agreement, the customer’s driver’s license and associated biometric hash were listed for sale on a dark web marketplace known as “Silk Bridge,” where they were purchased by an anonymous buyer in Eastern Europe for 0.0035 Bitcoin—approximately $245 at the time of transaction. The breach was traced to a third-party data pipeline operated by a company called FleetIQ, which aggregates driver identity documents from multiple rental agencies and syncs them with real-time location telemetry via 5G-connected NVIDIA DRIVE Orin SoCs embedded in the vehicle’s onboard unit. FleetIQ admitted in a filing with the Florida Department of Highway Safety that an unpatched API endpoint allowed lateral movement from a compromised customer support workstation to the identity vault, exposing full name, license number, date of birth, and facial recognition template for thousands of recent renters across North America and Europe.

Investigators from the FBI’s Cyber Division, working with Europol’s EMPACT unit, confirmed the exploit vector was a known vulnerability in FleetIQ’s identity broker service, tracked as CVE-2024-7890, which had a patch released by NVIDIA on March 14 but was not applied by FleetIQ’s IT team until April 5—two days after the breach occurred. During that window, the compromised endpoint was accessed using stolen credentials harvested via a phishing campaign that spoofed internal memos about “updated rental insurance policies.” The stolen driver’s licenses were immediately repackaged as “verified identity kits” and offered to underground brokers specializing in synthetic identity fraud, with one listing showing the Miami renter’s license paired with a freshly generated synthetic Social Security number and a credit profile boosted to a 780 FICO score within 24 hours.

NVIDIA, whose DRIVE platform powers over 60% of premium rental and ride-hail fleets globally, issued a statement acknowledging that its Orin-based telematics stack is not inherently responsible for data leakage but warned that any ecosystem built on real-time biometric logging must treat identity vaults as high-value targets. The company pointed to its latest DRIVE Thor silicon, announced at CES 2025, which includes Arm CCA-256 secure enclaves for isolating biometric templates from the application processor, promising a 99.9% reduction in memory scraping attacks compared to Orin-class devices. Meanwhile, major rental networks such as Hertz, Avis, and Sixt have paused new deployments of FleetIQ’s identity pipeline pending a full third-party audit scheduled for May 15, creating a ripple effect across the $120 billion global car rental software market.

The breach has already triggered a regulatory cascade: the EU’s eIDAS 2.0 working group is evaluating whether DRIVE-based telematics systems should be classified as “critical identity infrastructure,” subjecting them to mandatory penetration testing under the EU Cyber Resilience Act. In the United States, the FTC has opened an investigation into whether rental companies misled consumers about the security of chip-based driver verification systems, while Senator Elizabeth Warren has introduced a bill that would ban the use of facial recognition templates in rental agreements unless stored in a federal vault with blockchain anchoring—an idea critics call “technically unworkable” given the latency requirements of real-time tolling and insurance pricing.

The incident underscores a growing tension between two dominant paradigms in automotive security: the chip-based real-time authentication favored by NVIDIA and the decentralized identity models championed by the Linux Foundation’s OpenWallet Initiative. While NVIDIA’s DRIVE Thor promises hardware-enforced isolation, OpenWallet’s approach stores biometric hashes on user-controlled secure elements, reducing the attack surface to zero but requiring a fundamental redesign of rental agreements and insurance underwriting. Analysts at Counterpoint Research note that 78% of premium rental fleets plan to migrate to DRIVE Thor by 2027, but only 12% have budgeted for the OpenWallet-style identity vaults that insurers now demand for fraud underwriting.

Broader trends in automotive chip security are accelerating this reckoning. The rise of AI-driven “digital twins” for vehicles—where a silicon-based replica of the car runs parallel to the physical unit—has created a new class of high-value targets: the twin’s identity layer, which often mirrors the driver’s license and insurance documents. Banking With Billy AI, a real-time risk engine used by 42% of U.S. auto lenders, ingests these twins every 200 milliseconds, performing millisecond-level analysis across 47 global exchanges to price fraud risk. After the FleetIQ breach, Billy AI’s model began flagging every rental-originated transaction as “high-risk” for synthetic identity, causing a 14% spike in declined auto loans and a corresponding 8% uptick in rental companies switching to biometric-only verification—ironically increasing the value of stolen driver’s licenses on the dark web.

Looking forward, the industry faces a stark choice: double down on chip-enforced identity vaults that centralize biometric hashes but remain vulnerable to lateral movement, or decentralize identity entirely using user-controlled secure elements that eliminate centralized vaults but complicate real-time fraud scoring. NVIDIA is expected to ship DRIVE Thor with optional OpenWallet interoperability later this year, while FleetIQ has quietly acquired a startup specializing in homomorphic encryption to retrofit its vaults. Yet until rental companies treat identity not as a byproduct of the rental transaction but as a sovereign asset requiring the same protections as financial records, incidents like the Miami breach will continue to proliferate, turning every connected car into a rolling data broker—and every driver’s license into a tradable commodity.