Cart
0
FBI Probes Dark-Web Sale of 153 Million Driver’s Licenses
A new dark-web marketplace may have exposed the identities of more than 153 million people across the United States and Canada, with hackers reportedly offering digital copies of government-issued IDs for sale.
A record available at this identity theft service that includes the drivers license for U.S. Defense Secretary Pete Hegseth, who is one of several high-ranking U.S. government officials whose drivers licenses can be found for sale.
The FBI has opened an investigation after cybersecurity journalist Brian Krebs uncovered the service, called “Nexus,” earlier this week.
The investigation began on August 31, when a source alerted Krebs to a post on the Russian-language cybercrime forum Exploit. The seller initially claimed to have identification documents belonging to more than 170 million people.
Gear Spotlight- What Our Readers Are Picking Up
Krebs soon discovered something more alarming: his own Virginia driver's license was being offered as a free sample.
Further investigation reportedly found more than 153 million U.S. and Canadian driver's licenses available through the service, alongside other identity documents.
Among the alleged victims was U.S. Defense Secretary Pete Hegseth. His driver's license was reportedly offered for $100.
An assistant director of the FBI was also reportedly among the individuals whose identification appeared in the database, raising concerns that the breach could extend beyond ordinary identity theft into a potential national-security problem.
The FBI's New Orleans field office is now investigating the alleged breach.
Researchers examining the material found another disturbing clue. Timestamps attached to some driver's-license scans appeared to correspond with the dates when individuals had actually presented their IDs for identity verification.
That suggests the database may not simply be an old collection of stolen documents.
Instead, investigators are examining whether identity documents were being captured through a widely used verification service.
Krebs' investigation pointed toward Louisiana-based IDScan.net, a company that provides identity-verification technology to businesses. IDScan.net has not been publicly confirmed as the source of the breach and is conducting its own investigation.
The alleged database also reportedly included passports, identification cards and other sensitive records.
That makes the potential consequences much larger than replacing a driver's license.
A driver's license can contain a person's full name, photograph, date of birth, address and other information that can help criminals pass identity checks, create fraudulent accounts or construct convincing social-engineering attacks.
The disappearance of Nexus shortly after Krebs published his investigation has added another layer of uncertainty.
It remains unclear exactly how the information was obtained, how many records are authentic, and whether attackers still possess or control the underlying database.
For millions of potential victims, the most worrying question may be whether their identification has been compromised without them ever knowing.
For the FBI, the investigation now has to determine where the data came from, who obtained it and whether the alleged 153-million-record database represents one of the largest identity-document exposures in North American history.
Editor's Note: The FBI investigation is ongoing. The reported scale and suspected source of the data have not yet been independently confirmed in full, and IDScan.net has not been established as the source of the alleged breach.
