The FBI is investigating a dark web service that claims to have amassed over 153 million driver's license records from the United States and Canada, along with millions of other identification documents and hundreds of thousands of medical cards. The service, identified as Nexus, appeared on a Russian-language cybercrime forum on August 31, advertising access to identity documents for over 170 million people in North America.
While the exact number of unique individuals affected has not been independently verified, researchers who examined the service found evidence supporting the claim of an enormous collection. Cybersecurity journalist Brian Krebs reported that the driver's license total increased significantly in a short period while he was investigating, and that the operators claimed to have been continuously collecting data for over a year. Some records included images of both the front and back of licenses, as well as infrared and ultraviolet versions.
Investigators began tracing the origin of the records by examining timestamps attached to some of the images. Krebs discovered his own driver's license among the samples, with timestamps suggesting that the data could be linked to instances where individuals presented their identification. Researchers, including Zach Edwards, found their own licenses with timestamps correlating to travel or other activities where their IDs were scanned.
These findings led researchers to investigate Louisiana-based identity verification company IDScan.net, which had announced a partnership with a Las Vegas marijuana dispensary. IDScan.net has since acknowledged a security incident, stating that an unauthorized third party may have accessed or copied customer information stored in its cloud accounts, which could include names and government-issued identification numbers. The company is notifying affected individuals and offering credit monitoring, but has not confirmed that the Nexus collection originated from its systems.
In a statement to Reuters, the FBI confirmed it was "looking into the incident" but could not provide further details due to the ongoing investigation. If confirmed at the reported scale, the breach could be one of the largest exposures of government-issued identity documents in North America. Shortly after the investigation was published, the Nexus dark web site reportedly disappeared.
Driver's licenses contain a wealth of personal information, including full names, addresses, dates of birth, license numbers, photographs, and signatures, making them valuable to criminals for identity theft and impersonation attempts. The potential misuse of these compromised records poses significant risks for identity theft and could have national security implications.
To protect against potential misuse of personal information, experts recommend several steps, including placing a credit freeze with the major credit bureaus, regularly reviewing credit reports for suspicious activity, monitoring existing financial accounts for unauthorized transactions, securing email and phone accounts with strong passwords and multi-factor authentication, and considering identity theft protection services. In the event of discovered identity misuse, reporting the incident promptly to the FTC via IdentityTheft.gov and contacting state motor vehicle agencies is advised.