US, Canada Driver's Licence Data On Dark Web: What To Know As FBI Probes 153 Million Records

(MENAFN- Live Mint) A new identity theft service on the dark web is reportedly offering digital scans of more than 153 million driver's licences belonging to people in the United States and Canada, raising serious concerns over identity theft and data security.

The discovery was reported by KrebsOnSecurity, a cybersecurity blog run by Brian Krebs, a former Washington Post reporter with expertise in cybersecurity. The report said the FBI's New Orleans field office has opened an investigation into the suspected source of the data.

What is the Nexus service?

The service, called Nexus, was advertised on the Russian cybercrime forum Exploit on August 31. Its operators claimed to possess identity documents belonging to more than 170 million people across North America.

According to KrebsOnSecurity, the database includes more than 153 million driver's licences, over 10 million identification cards, more than 3 million travel documents or international IDs, and at least 579,000 medical cards.

The database reportedly contains records from both the US and Canada, although Americans make up the majority. A search for Canadian driver's licences alone returned about 1.1 million results, with Ontario accounting for nearly 474,000.

Fresh data allegedly being added

Nexus claimed that the information came from an ongoing breach at a major identity verification company serving Fortune 500 businesses.

The operators claimed they had been continuously extracting data for more than a year. KrebsOnSecurity also observed that the number of driver's licence records increased by almost 400,000 in just 24 hours, suggesting that new data was still being uploaded.

Some records reportedly contained multiple images of a licence, including photographs of both sides as well as infrared and ultraviolet scans.

IDScan emerges as possible source

Krebs' investigation pointed towards IDScan, a Louisiana-based identity verification provider, as a possible source of the leaked information.

The company's technology scans identification documents using infrared and ultraviolet light. IDScan says its systems conduct more than 21 million identity verifications each month at more than 20,000 locations worldwide.

KrebsOnSecurity found that timestamps attached to several licences corresponded with occasions when individuals had travelled, rented vehicles or visited businesses where their identification was scanned.

Several people whose licences appeared in Nexus had rented vehicles from Hertz around the dates shown in the timestamps.

FBI launches investigation

The FBI's New Orleans field office has now opened an official investigation into an apparent breach involving IDScan, according to KrebsOnSecurity.

IDScan told KrebsOnSecurity that it was investigating the matter but did not provide substantive answers to specific questions.

Jillian Kossman, a marketing and operations leader at the company, said:“At this point I'm not able to share any additional information,” while describing the information provided by Krebs as helpful to the company's investigation.

Why the breach is concerning

Cybersecurity researchers warned that stolen driver's licence scans could have serious consequences because such documents are widely used to verify identities and open financial accounts.

Larry Baldwin, principal intelligence researcher at cybersecurity firm Cybera, said the data could also put vulnerable people at risk, including domestic violence survivors and individuals protected through witness protection programmes.

“This happens and the very thing those improvements are dependent on are compromised,” Baldwin said, referring to efforts to strengthen identity authentication through driver's licence verification.

Privacy researcher Zach Edwards similarly warned that increasingly widespread requirements to submit driver's licences are creating large pools of sensitive information at third-party companies without sufficient oversight.

Nexus disappears from dark web

Shortly after KrebsOnSecurity published its report, the Nexus website reportedly disappeared from the dark web. Its login page was replaced with a message stating:“This service is no longer available.”

The disappearance, however, does not establish that the allegedly stolen data has been deleted. The FBI investigation into the suspected breach and the source of the identity documents remains ongoing.

Also Read | AI cyber risk is biggest immediate threat to global financial system: BoE chief

MENAFN06092026007365015876ID1111628068