The FBI has opened a formal investigation into a newly discovered dark-web service that offered digital scans of more than 153 million American and Canadian driving licences for sale, in what cybersecurity researchers describe as one of the largest exposures of government identification documents on record.
The bureau’s New Orleans field office launched its inquiry after cybersecurity journalist Brian Krebs, who runs the website KrebsOnSecurity, first reported on the marketplace, known as Nexus, after a source alerted him to a listing on the Russian-language cybercrime forum Exploit.
What is the Nexus dark-web marketplace?
According to Krebs’s reporting, a new user on the forum advertised searchable access to digital scans of identity documents belonging to more than 170 million people across North America. Krebs said the seller had included his own Virginia driving licence as a free sample to demonstrate the database’s authenticity.
A blank search of the Nexus database was found to return roughly 11.5 million pages of results, broadly consistent with the 153 million licences the operators claimed to hold, alongside millions of other identification and medical documents, including dispensary cards.
Where did the leaked documents originate?
Krebs traced the likely source of the breach to IDScan.net, an identity verification company based in the New Orleans area, whose client list is reported to include Hertz, Target, FedEx, Caesars Entertainment, Motorola Solutions and the financial services firm Jack Henry.
Nexus’s operators told the cybercrime forum they had been quietly extracting data from their source for more than a year before making the service public, with the total number of records reportedly rising by close to 400,000 within a single 24-hour window, a pattern researchers say points to an ongoing, automated harvesting operation rather than a single one-off theft.
What information do the stolen records contain?
Each compromised record can reportedly include up to six separate image files per licence, showing the front and back of the document in standard, infrared and ultraviolet scan formats, the kind of detailed imagery typically used to authenticate identification at rental car counters, retail checkouts and age-verification kiosks. Zach Edwards, a threat researcher at the cybersecurity firm Infoblox, said the scale of the exposure was unprecedented, noting that “there’s never been a breach of driver’s licenses at this scale.”
Who has been affected by the breach?
Krebs reported that the exposed records include the driving licence of US Secretary of War Pete Hegseth, alongside other senior federal officials, a detail Edwards said elevated the breach beyond a consumer privacy issue into a matter of genuine national security concern given the seniority of those affected. Reuters separately reported finding Edwards’s own documentation within the leaked data, though it said it could not independently confirm where the material had originated.
How have the companies involved responded?
A representative for IDScan.net, marketing and operations lead Jillian Kossman, told Krebs in an email that the company was continuing to investigate the matter but was “not able to share any additional information” at this stage, while acknowledging that the updates Krebs had provided had been helpful to its internal review. Shortly after Krebs published his findings, the Nexus website disappeared from the dark web, with its login page replaced by a notice stating the service was “no longer available.”
What has the FBI said about its investigation?
The FBI’s New Orleans field office confirmed it had opened an investigation after learning that some of the stolen identification documents may belong to its own agents, according to reporting from the cybersecurity outlet Security Affairs. Neither the bureau nor IDScan.net has yet issued a detailed public statement confirming the precise scope of the breach or how the intrusion first occurred.
What should people do if they think they have been affected?
Cybersecurity researchers have urged anyone who has presented a driving licence to a third-party identity verification service, whether at a car rental counter, retail kiosk or online age-verification prompt, to treat the exposure as a tangible risk of document forgery and identity fraud.
Krebs told Time magazine the stolen data set would likely retain significant value to cybercriminals for years to come, warning that a similar service was likely to resurface on the dark web even after Nexus’s apparent shutdown.
Consumer protection specialists recommend placing a fraud alert or credit freeze with major credit bureaus, monitoring for new-account fraud, and reporting suspected misuse through the FBI’s Internet Crime Complaint Center or the Federal Trade Commission’s identity theft recovery portal.
