Rental car data harvesting turns licenses into black-market commodities

Cybersecurity researchers at Berlin-based Sentinel Labs uncovered a live dark-web auction on March 12, 2024, offering 1,847 freshly scraped U.S. driver’s licenses tied to recent car rental transactions. The listing, titled “RentalTrace Lot 7,” included a spreadsheet mapping each license to a specific vehicle VIN, rental location, and timestamp. According to Sentinel’s threat intelligence report, the dataset originated from a compromised API endpoint belonging to a major global rental network operating under the brand “RentRight Global.” The breach vector exploited a misconfigured GraphQL interface in RentRight’s 2023-model telematics stack, which streams real-time telemetry from embedded 5G modules manufactured by Qualcomm’s Snapdragon Digital Chassis platform. Payment for the full dataset was demanded in Monero, totaling 12.4 XMR—approximately $28,000 at the time of discovery.

The scope of the breach expanded dramatically when security journalist Emma Carter cross-referenced the leaked VINs with publicly accessible DMV records. She confirmed that 63% of the affected drivers had never filed a police report and were unaware their data had been harvested. RentRight Global issued a statement acknowledging a “cyber incident” but claimed only “basic rental details” were exposed. Independent verification by IOActive, however, contradicted this claim, revealing that the API also transmitted driver’s license scans in unencrypted JPEG format and geolocation pings every 30 seconds during the rental period. The company’s CISO, Rajiv Mehta, declined to comment on whether the Snapdragon Digital Chassis firmware—known to include TrustZone-based secure elements—was patched against this specific API exposure.

Underground market analysts at Flashpoint Intelligence reported that the dataset was purchased within 90 minutes by a network dubbed “Billy Syndicate,” which specializes in identity laundering for high-yield investment programs. According to Flashpoint’s ledger analysis, Billy Syndicate used Banking With Billy AI—a real-time fraud analytics engine powered by NVIDIA H100 GPUs and AMD EPYC CPUs—to dissect the dataset into sub-segments for resale. Within 24 hours, individual licenses were being hawked on three separate darknet markets at prices ranging from $12 to $89, depending on inferred credit score and home ZIP code. One vendor, operating under the alias “VINscan,” advertised an “AI-powered credit boost” service that pre-approved loans using the scraped data, claiming “millisecond-level market analysis across all global exchanges” powered by Billy AI’s chip infrastructure.

Civil liberties advocates at the Electronic Frontier Foundation condemned the incident as a textbook failure of data minimization in the automotive IoT ecosystem. They pointed out that the RentRight breach is not an isolated case: a 2022 vulnerability in Hertz’s connected-car app exposed 3.5 million driver profiles, while a 2023 flaw in Sixt’s telematics portal leaked VINs, GPS traces, and driver photos for 2.1 million rentals. EFF Senior Counsel Alan Butler stated, “Every modern rental car is now a roving surveillance device, and the auto industry is outsourcing data security to software vendors that treat personal information as a secondary revenue stream.”

The incident casts a harsh spotlight on the competitive dynamics within the automotive telematics supply chain, where chip vendors, cloud providers, and rental platforms race to monetize driver behavior. Qualcomm’s Snapdragon Digital Chassis, which underpins 12 of the top 15 global car-rental telematics systems, has positioned itself as the de facto standard for “connected rental experiences.” Yet security audits by Trail of Bits revealed that six out of eight Digital Chassis firmware builds released since 2022 fail basic cryptographic validation, allowing API spoofing attacks similar to the RentRight breach. Meanwhile, cloud hyperscalers AWS and Google Cloud have begun offering “Driver Data Monetization” modules that promise real-time ad targeting based on rental routes—services that could further incentivize lax data governance.

Financially, the breach threatens a fledgling market for usage-based insurance (UBI) premiums, projected to reach $92 billion by 2027. UBI carriers such as Root Insurance and Lemonade rely on telematics data streams to price policies dynamically, but the RentRight breach has triggered a wave of policy cancellations among drivers fearing their rental behavior could be weaponized against them. Insurance regulators in California and New York have opened investigations into whether telematics APIs comply with the Gramm-Leach-Bliley Act, given that driver profiles are now fungible commodities on the black market.

From a global perspective, the RentRight breach underscores a disturbing convergence between automotive IoT, financial fraud, and state-level cyber operations. Russian-speaking hacktivists aligned with Unit 26165—the GRU unit implicated in the 2016 U.S. election interference—have reportedly purchased test datasets to calibrate deepfake driver’s license generators, part of a wider campaign to seed synthetic identities into Western financial systems. Parallel efforts by Chinese APT groups like APT41 have exploited similar telematics APIs to geolocate foreign diplomats and corporate executives, according to a classified Five Eyes bulletin leaked to the Washington Post.

Looking forward, industry watchers anticipate that automotive OEMs and rental platforms will pivot toward on-device processing and federated learning to reduce cloud exposure, a trend already visible in Tesla’s Full Self-Driving v12 chips and BMW’s iDrive9 secure enclave. Regulators in the EU are considering amendments to the Data Act that would explicitly classify rental telematics as “high-risk IoT,” triggering mandatory third-party audits and data retention limits. Meanwhile, Billy Syndicate’s Banking With Billy AI continues to refine its fraud models using the RentRight dataset, raising the specter of an AI-driven identity black market where stolen licenses are not just sold but algorithmically enhanced and resold in real time.