The FBI has confirmed that it is investigating a report of dark web services selling digital scans of over 153 million driver’s licenses from the US and Canada. The New Orleans field office has opened a case but cannot provide further details due to the ongoing investigation.

Independent journalist Brian Krebs discovered a service named Nexus listed on the Russian cybercrime forum Exploit on August 31, where the seller claims to possess identity documents of over 170 million people in North America, including about 153 million driver’s licenses, over 10 million other ID cards, over 3 million travel or international documents, and at least 579,000 medical cards, stating that the data has been leaking for over a year; the number of driver’s licenses increased by nearly 400,000 in one day. A blank search yields about 11.5 million pages, with approximately 15 entries per page. About 1.1 million Canadian licenses are included, with over 473,000 from Ontario. Krebs intervened after his Virginia driver’s license was used as a free sample, confirming with nine individuals that the scans were legitimate, which included licenses of officials such as Defense Secretary Pete Hegseth and FBI Assistant Directors, with some scans showing both sides and infrared and ultraviolet scans.

Timestamp and rental records point to the Louisiana identity verification company IDScan.net, which claims to verify about 21 million times a month across over 20,000 locations, with clients including Hertz, Target, FedEx, Motorola Solutions, Jack Henry, Caesars Entertainment, and cannabis chain Planet13. Several verified individuals had only submitted their licenses to Hertz and had not used them for boarding flights. The company stated it is investigating and has not confirmed the leak. About two hours after the report was released, the dark web site went offline. Some scans were priced at around $100.

The risks include identity theft, account opening fraud, and exposure of addresses of domestic violence shelter residents and witness protection subjects. If confirmed, this would be one of the largest exposures of government-issued identity documents in North America.

Who is buying and who is selling: The incident is driven by verification service providers keeping driver’s license scans as searchable databases, rather than a breach of the DMV mainframe. Buyers are fraudsters involved in account opening and synthetic identity schemes, while sellers are dark web shops claiming long-term leaks. Beneficiaries are those who can replicate physical documents using front and back scans with ultraviolet light, while those under pressure are rental car retail banks that outsource verification to the same scanning provider. Funds flow from counter verification fees to the dark web, where identities are priced per entry.

Source: Public Information