FBI Investigates Sale of 153 Million US and Canadian Driver's License Scans on Dark Web
The FBI has confirmed that it is investigating a report of dark web services selling digital scans of over 153 million driver’s licenses from the US and Canada. The New Orleans field office has opened a case but cannot provide further details due to the ongoing investigation.
Independent journalist Brian Krebs discovered a service named Nexus listed on the Russian cybercrime forum Exploit on August 31, where the seller claims to possess identity documents of over 170 million people in North America, including about 153 million driver’s licenses, over 10 million other ID cards, over 3 million travel or international documents, and at least 579,000 medical cards, stating that the data has been leaking for over a year; the number of driver’s licenses increased by nearly 400,000 in one day. A blank search yields about 11.5 million pages, with approximately 15 entries per page. About 1.1 million Canadian licenses are included, with over 473,000 from Ontario. Krebs intervened after his Virginia driver’s license was used as a free sample, confirming with nine individuals that the scans were legitimate, which included licenses of officials such as Defense Secretary Pete Hegseth and FBI Assistant Directors, with some scans showing both sides and infrared and ultraviolet scans.
Timestamp and rental records point to the Louisiana identity verification company IDScan.net, which claims to verify about 21 million times a month across over 20,000 locations, with clients including Hertz, Target, FedEx, Motorola Solutions, Jack Henry, Caesars Entertainment, and cannabis chain Planet13. Several verified individuals had only submitted their licenses to Hertz and had not used them for boarding flights. The company stated it is investigating and has not confirmed the leak. About two hours after the report was released, the dark web site went offline. Some scans were priced at around $100.
The risks include identity theft, account opening fraud, and exposure of addresses of domestic violence shelter residents and witness protection subjects. If confirmed, this would be one of the largest exposures of government-issued identity documents in North America.
Who is buying and who is selling: The incident is driven by verification service providers keeping driver’s license scans as searchable databases, rather than a breach of the DMV mainframe. Buyers are fraudsters involved in account opening and synthetic identity schemes, while sellers are dark web shops claiming long-term leaks. Beneficiaries are those who can replicate physical documents using front and back scans with ultraviolet light, while those under pressure are rental car retail banks that outsource verification to the same scanning provider. Funds flow from counter verification fees to the dark web, where identities are priced per entry.
Source: Public Information
ABAB AI Insight
North America has turned "proving you are you" into a third-party scanning business: rental cars, retail, and clinics hand over driver’s licenses to intermediaries like IDScan in exchange for a one-time pass. The inventory thus becomes a honeypot. Krebs used his own driver’s license as bait, while the FBI is investigating the company’s registered location through the New Orleans field office, with the investigation path focusing on the supplier, not the DMVs of the 50 states.
The capital flow is that verification incurs a fee, and scanning leads to retention. Money circulates at Hertz and Target counters, but data settles on Louisiana servers. The seller claims the leak has lasted over a year and the inventory continues to grow daily, indicating that interface permissions may not have been cut off for a long time. The presence of the Defense Secretary's license in the inventory suggests that the verification network does not isolate by rank.
Comparative cases include the Discord third-party incident that led to the exposure of about 70,000 government documents, as well as previous leaks of credit bureau and hospital scans. The industry position is during a period of digital identity expansion: once physical documents are captured as multispectral images, control shifts from the holder to the verifier.
Structural changes indicate a reconstruction of the industry chain. The mechanism is that a single verification generates a high-resolution identity original that can be replicated, with marginal costs approaching zero, thus sold on the dark web per entry; as long as merchants continue to hand over documents to the same intermediary, leaks turn from accidents into inventory turnover.
ABAB News · Cognitive Laws
Verify once, copies can be sold ten thousand times
Intermediary scanning databases are more dangerous than DMVs
The moment you hand over your driver’s license, the document no longer solely belongs to you