The dark web has given birth to a new identity theft service that’s selling digital scans of over 153 million drivers’ licenses from the United States and Canada. This staggering number was confirmed by interviews with individuals whose licenses are available for purchase on this service, which claims to have obtained these images from an active breach at a widely-used identity verification company.
The service, dubbed Nexus, has been advertised on the Russian cybercrime forum Exploit, where it’s being offered as a veritable treasure trove of personal identification documents. For a price, customers can gain access to digital scans of not only drivers’ licenses but also identification cards, travel documents, and even medical cards. The service’s proprietor claims that these records come from an ongoing breach at an identity verification company whose clients include multiple Fortune 500 companies.
What’s most disturbing about this development is the sheer scale of the data being sold. With over 153 million drivers’ licenses on offer, it’s clear that Nexus has been harvesting fresh stolen license data for some time. In fact, the number of available records increased by nearly 400,000 in just 24 hours, suggesting a steady stream of new data is being uploaded to the service.
As KrebsOnSecurity dug deeper into this story, we discovered that the FBI’s New Orleans field office has launched an official inquiry into the source of these images. It’s unclear at this point whether the breach was an inside job or an external attack, but it’s clear that the security measures put in place by the identity verification company were insufficient.
The data itself is also telling. Many of the records include photos of the license holder, as well as infrared and ultraviolet versions of the images. Some even feature timestamps that correspond to specific travel dates, suggesting that the stolen data has been linked to legitimate use cases – perhaps for travel or financial transactions.
What’s most worrying about this story is the potential for identity theft on a massive scale. With so many drivers’ licenses available for purchase, it’s only a matter of time before malicious actors start using this information to commit crimes like credit card fraud or even more serious offenses. The fact that high-ranking government officials, including U.S. Defense Secretary Pete Hegseth, have had their licenses sold on the service is a stark reminder of the risks involved.
So what can you do to protect yourself? For starters, be wary of any websites or services that ask for your driver’s license information. Make sure you’re using strong passwords and keeping an eye out for suspicious activity on your credit reports. And if you’ve had your license scanned by a legitimate identity verification company, take steps to monitor your personal data and report any discrepancies promptly.
Ultimately, this story highlights the importance of robust security measures in protecting sensitive data. Identity verification companies must do better to safeguard their customers’ information, and law enforcement agencies must remain vigilant in tracking down these types of breaches. As for you, stay vigilant – your identity is worth it.
Source: Krebs on Security — 2026-09-01