153 Million Driver License Images Offered on Dark Web

Cybercriminals posted digital scans of more than 153 million US and Canadian driver’s licenses on a dark web identity theft service called Nexus. The data is believed to have been exfiltrated from a breach at IDScan.net, an identity verification company serving multiple industries and Fortune 500 clients. The stolen data includes driver’s licenses, identification cards, travel documents, and medical cards. Nexus was shut down after public exposure, and the FBI has launched an investigation. The breach underscores the vulnerability of identity verification platforms and the potential for large-scale identity theft.

The exposure of over 153 million driver’s licenses and other identity documents poses significant risks of identity theft and fraud. The data includes sensitive personal information from US and Canadian individuals, including some FBI agents. This breach could facilitate fraudulent activities such as account takeovers, synthetic identity creation, and unauthorized access to services relying on these IDs for verification.

No official patch or fix applies as this is a data breach incident. The Nexus platform selling the data was shut down shortly after exposure. The FBI is investigating the breach. Organizations relying on identity verification should assume that identity evidence may be compromised and implement stronger verification processes beyond document authenticity. Individuals should avoid sharing copies of their driver’s licenses unless necessary and inquire about how their ID data is handled during verification. Organizations should enforce strict data access controls, logging, retention policies, and monitor for abnormal data access to prevent similar breaches.