Dark Web Exposes 153M Driver's Licenses in Massive ID Theft
FBI probes breach linked to major identity verification firm
1The Scale of Exposure
A dark web service named Nexus is selling digital scans of over 153 million U.S. and Canadian driver's licenses, plus 10M ID cards, 3M travel documents, and 579K medical cards. The database includes high-profile figures like Defense Secretary Pete Hegseth and cybersecurity journalist Brian Krebs, whose Virginia license was offered as a free sample. Search results suggest the 153M claim is credible, with 11.5M pages of records showing 15 entries per page.
2FBI Launches Investigation
The FBI's New Orleans field office has opened an inquiry into the source of the leaked documents. Evidence points to IDScan.net, a Louisiana-based identity verification company processing 21M verifications monthly for clients like Target, FedEx, and Caesars Entertainment. Timestamps on leaked licenses match real-world transactions where users submitted IDs for services like hotel stays or car rentals.
3Russian Cybercrime Connection
Nexus debuted on the Russian-language Exploit cybercrime forum on August 31, advertising access to 170M North American identity documents. The service's rapid growth added 400K licenses in 24 hours, suggesting continuous data exfiltration for over a year. Operators claim to have specialized scans including infrared/UV versions of IDs, indicating sophisticated capture methods.
4Document Diversity Exposed
Beyond standard licenses, the breach includes marijuana dispensary cards, Common Access Cards (CACs) for government facilities, and commercial driver's licenses (CDLs). Canadian records comprise 1.1M entries, with Ontario's 473,673 licenses being the largest regional cluster. The variety suggests multiple infiltration points across verification systems.
5IDScan.net's Corporate Reach
The suspected source company serves 20,000 global locations including Holiday Inn, 7-Eleven, GameStop, and Shell. Its integration with major brands means millions submit IDs daily for age verification, rentals, or loyalty programs. This widespread adoption created a single point of failure compromising both consumer and government identities.
6Verification Economy Vulnerabilities
The breach highlights systemic risks in identity verification systems that retain document copies indefinitely. Unlike one-time checks, these systems store sensitive data long-term, creating honeypots for hackers. With licenses containing addresses, birthdates, and sometimes biometrics, victims face lifelong fraud risks from a single exposure.
7Operational Patterns
Nexus operators demonstrate professional data management, categorizing records by source (CAC, CDL) and jurisdiction. The inclusion of document backs—where verification barcodes reside—enables counterfeiters to create fully functional fake IDs. Some entries even show multiple scan types (visible light, UV) used for advanced forgery detection.
8Government Impact
High-ranking officials' compromised licenses pose national security risks, as CAC cards grant Pentagon access. Defense Secretary Hegseth's exposure suggests military-affiliated records were targeted. The breach could enable impersonation at secure facilities or provide foreign actors with personnel tracking capabilities.
9Consumer Consequences
Victims may face account takeovers, tax fraud, or medical identity theft using exposed data. Unlike credit cards, driver's licenses can't be reissued with new numbers, forcing victims to monitor fraud indefinitely. States charge $25-$50 for license replacements, creating financial burdens for millions.
10Industry Response
IDScan.net stated it's investigating but hasn't confirmed being the source. The company's silence contrasts with its client list of Fortune 500 brands, raising questions about liability. Unlike credit bureaus, ID verification firms lack standardized breach protocols, leaving victims without clear recourse.
11Systemic Reckoning Needed
This breach exposes the paradox of digital identity: convenience creates irreversible risks. Solutions may require eliminating permanent document storage, adopting ephemeral verification tokens, or government-issued digital IDs. Until then, the verification economy remains a goldmine for criminals, with 153M lives now in the balance.
Original article: Krebs on Security — Dark Web Exposes 153M Driver's Licenses in Massive ID Theft