FBI Investigates Service Selling 153M+ Driver's Licenses

The Federal Bureau of Investigation (FBI) has launched an inquiry into a new identity theft service operating on the dark web, identified as Nexus, which is reportedly selling digital scans of over 153 million driver's licenses from individuals in the United States and Canada. The service, advertised on the Russian cybercrime forum Exploit, claims to possess a vast repository of personal identification documents, including more than 10 million identification cards, over three million travel documents and international IDs, and at least 579,000 medical cards. Initial observations suggest the service's claim of over 153 million driver's licenses may not be an exaggeration, as a blank search within Nexus yielded approximately 11.5 million pages of results, with roughly 15 results per page. The data appears to originate from a widely-used identity verification company based in Louisiana, according to interviews with individuals whose licenses were found for sale. Among the compromised documents is the driver's license of U.S. Defense Secretary Pete Hegseth, indicating the potential compromise of high-ranking government officials' personal information. The proprietor of the Nexus service offered a sample of a Virginia driver's license to a source who alerted KrebsOnSecurity to the operation. While the service includes documents from both Canada and the United States, the majority of the records pertain to American citizens. A specific search for Canadian driver's licenses returned approximately 1.1 million results, with the largest concentration of these records originating from within Canada. The FBI's New Orleans field office is leading the investigation into the source and extent of this data breach. The emergence of Nexus highlights ongoing threats to personal data security and the sophisticated methods employed by cybercriminals to exploit sensitive information for illicit purposes. Identity verification companies, which handle vast amounts of personal data for legitimate business purposes, represent a critical point of vulnerability in the digital ecosystem, necessitating robust security measures and vigilant oversight to prevent such large-scale data compromises. The scale of this operation, involving over 153 million driver's licenses, underscores the pervasive nature of identity theft and the significant challenges faced by law enforcement in combating these evolving criminal enterprises.