FBI Probes Service Selling 153M+ Drivers Licenses

Krebs on Security ^ | 09/01/2026 | Brian Krebs

[Drago]

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that the New Orleans field office of the Federal Bureau of Investigation (FBI) today launched an official inquiry into the source of the images. On Monday, Aug. 31, a source alerted KrebsOnSecurity to a service advertised by a new user on the Russian cybercrime forum Exploit, offering access to digital scans of identity documents on more than 170 million people in North America. The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit.

The service, dubbed Nexus, claims to have more than 153 million drivers licenses for people in the United States and Canada, as well as more than 10 million identification cards; more than three million travel documents and/or international IDs; and at least 579,000 medical cards.

---

TOPICS:
KEYWORDS: breach; darkweb; data; licenses

[Drago]

Yet another data breach...Peter Hegseth was the featured DL at the dark Web hacker "Nexus" site...since taken down. The "KYC" ID company that may have been the source (hacked) is "IDScan".

[Rural_Michigan]

Is this why people don’t seem to know how to drive anymore?

[Drago]

Ha! ;-) But this is existing drivers licenses that were in a database..Hegseth’s DL data/photo prominently featured.

[Ex-Con777]

Or vote.

EC

[Carry_Okie]

So do these scanned DLs pass the test for Real ID?

[Vaduz]

Yet another data breach

Ain’t technology grand Moe.

[Carry_Okie]

From Brave AI:

When Whole Foods scans your driver’s license for a return, the data is typically stored by The Retail Equation (TRE), a third-party data broker.

Data Aggregation: TRE compiles return histories across multiple retail chains, tracking your return frequency, dollar amounts, and whether you had a receipt.

Fraud Prevention: Stores participate in this system to identify and block customers who they perceive as abusing return policies or engaging in fraudulent returns.

Data Retention: While some retailers claim not to store data, TRE retains this information to build a profile of your shopping behavior. You may be able to request the removal of this data, but the company monetizes the information it collects.

The Driver’s Privacy Protection Act (DPPA) does not apply to these transactions because it only restricts state motor vehicle departments from disclosing information, not private retailers scanning data directly from you.

[PGalt]

Very interesting. Thanks for posting.

[thinden]

o: Rural_Michigan

Or vote.

EC

xxxxxxxxxxx

that’s real value

[Buck-Toothed Knuckle Dragger]

Just understand that all of your stuff is out there in the wild. You have to hope that you remain one starling among tens of thousands and that the hawks don’t target you.

[vikingd00d]

None of the companies that store personal data care about security; there are never consequences for these breaches.
Perhaps that needs to change. They should have a fiduciary duty to protect that data, with massive penalties and legal and financial liabilities if they do not.

[Eli Kopter]

Don’t fall for the trap that you can somehow ‘protect’ yourself. There are plenty of built-in safeguards, but do the best you can do to change passwords often, etc., and quit worrying about it so much. If it happens, then you will overcome it. And, pray a lot.

[Presbyterian Reporter]

Thanks for the post of one example of where a Driver’s License gets scanned.

How about when you go to a doctor’s office or to a hospital where they scan your drivers license and and insurance card?

In the past year I have been notified by two different doctors and a hospital that my data has been hacked.

[OldHarbor]

Test drive an automobile from a car dealer .
They make a copy of the drivers license.

[devane617]

I visit doctors frequently in my old age and state of decay, and each one copies or requests images of my DL. The medical offices aren’t know for security so who knows where these images came from.