FBI Probes Dark-Web Service Selling 153M+ Driver's Licenses

A new identity theft service that appeared on the dark web this week is selling digital scans of more than 153 million drivers licenses belonging to people in the United States and Canada, and the Federal Bureau of Investigation has opened an inquiry into where the images came from.

What Nexus is selling

The service, named Nexus, was advertised on Aug. 31 by a newly registered user on the Russian-language cybercrime forum Exploit, promising access to scanned identity documents for more than 170 million people in North America. According to its own listings, Nexus holds more than 153 million drivers licenses, more than 10 million identification cards, over three million travel documents and at least 579,000 medical cards.

The numbers look credible rather than inflated: a blank search returns roughly 11.5 million pages of results at about 15 records per page. Canadian drivers licenses account for about 1.1 million records, the largest share — 473,673 — from Ontario.

The records include licenses of several high-ranking U.S. government officials, among them Defense Secretary Pete Hegseth. Security journalist Brian Krebs, who reported the findings, also found the license of an FBI assistant director for sale on the service; the license of FBI Director Kash Patel was not present.

Timestamps and a rental counter

Files in the service carry a date and timestamp appended to their names. Some records contain six images: photos of the front and back of a license, a basic scan, and infrared and ultraviolet versions of each. Researchers who checked licenses belonging to friends, family and colleagues found the timestamps clustered around dates when those people had travelled or rented cars.

The strongest lead pointed to a rental desk: the timestamps on the license images of two relatives who handed their documents to the same Hertz representative at the same moment were only seconds apart. The timestamps appear to be set to Greenwich Mean Time.

The FBI inquiry

The operators of Nexus claim the images come from an active breach at "a major identity verification company" whose customers include multiple Fortune 500 firms, and say they have been exfiltrating new data for over a year. Suspicion has fallen on idscan.net, a New Orleans-based identity verification provider whose technology scans IDs with infrared and ultraviolet light. The company said it is investigating the matter but declined to share additional information.

The FBI's New Orleans field office opened a formal investigation into an apparent breach involving idscan.net, and the bureau confirmed the inquiry on a call that included senior officials from its cyber division. Security and privacy researcher Zach Edwards, whose own license was found in the service, said the only place he was certain his ID was scanned during a recent Las Vegas trip was a marijuana dispensary that works with the company.