A dark web identity theft service is allegedly selling digital scans of more than 153 million American and Canadian drivers’ licenses, prompting the FBI to launch an investigation into what could be one of the largest exposures of government-issued identification documents ever reported.
Independent cybersecurity journalist Brian Krebs discovered the trove after a newly launched service called Nexus was advertised on a Russian cybercrime forum. The service claimed to possess more than 170 million identity documents, including more than 153 million drivers’ licenses, 10 million identification cards, more than three million travel documents, and hundreds of thousands of medical cards.
Krebs was initially alerted to the operation because the service was offering his own Virginia driver’s license as a free sample. He subsequently located the licenses of numerous other people and was able to verify that several of the records corresponded to real-world instances in which the individuals had presented their identification.
Among the records available through Nexus was a scan of Secretary of War Pete Hegseth’s driver’s license, according to Krebs. The database also contained identification belonging to other high-profile individuals, including even more government officials.
The database reportedly contained detailed images of identification documents rather than merely names or license numbers, potentially giving criminals access to photographs, addresses, dates of birth, document numbers, and other identifying information.
The FBI confirmed Wednesday that it was investigating the incident. “The FBI is aware of this report and is looking into the incident,” the bureau said in a statement, declining to provide additional details because of the “ongoing nature of the investigation,” according to Reuters.
Krebs found evidence suggesting the database may be connected to a Louisiana-based identity verification company called IDScan.net, although neither the company nor the FBI has publicly confirmed that it was the source of the stolen information.
The evidence came partly from timestamps embedded in some of the stolen images. Krebs found his own license in the database, along with his mother’s, with timestamps only seconds apart. The two had handed their licenses to a Hertz representative during a car rental.
Another security researcher, Zach Edwards, found his own license in the database and said its timestamp corresponded with a trip to Las Vegas. Edwards had presented his identification at several locations during the trip, but said the only place that definitively scanned his ID was a Planet 13 marijuana dispensary.
Planet 13 announced in 2022 that it had entered into an identity-verification agreement with IDScan.net. The company says its technology is used by businesses to scan and authenticate government-issued identification documents.
IDScan.net’s website says its technology processes more than 21 million identity verifications each month at more than 20,000 locations. Its listed customers and partners have included major companies such as Hertz, Target, FedEx, and others.
The stolen records also contained infrared and ultraviolet images of some licenses, in addition to ordinary scans of the front and back of the documents. Those details further suggested that the information came from commercial identity-verification systems capable of capturing more sophisticated images of identification documents.
The apparent breach seems to be ongoing. When Krebs first examined Nexus, the service claimed to have more than 153 million drivers’ licenses. The number increased by nearly 400,000 records over approximately 24 hours, suggesting that the database was allegedly being continually fed with newly stolen information rather than being a one-time dump of old records.
Cybersecurity researcher Edwards called the scale of the incident unprecedented. “There’s never been a breach of drivers’ licenses at this scale,” Edwards said.
The database disappeared from the dark web shortly after Krebs published his investigation. Its login page was replaced with a message stating, “This service is no longer available.”
It remains unclear how many people were actually affected or whether all of the records originated from the same source. The 153 million figure is the number claimed by the operators of Nexus, rather than a figure independently confirmed by the FBI.
IDScan.net told Krebs that it was investigating the matter but did not provide a substantive public explanation of whether its systems had been compromised or how many individuals may have been affected.
The FBI’s investigation remains ongoing.
.png)
.png)
