Image credit: Suzanne Kantra/Techlicious generated by ChatGPT
The FBI's has opened an investigation into a data breach that appears to have supplied a dark web marketplace with scans of more than 153 million U.S. and Canadian driver's licenses, along with millions of other identity documents. The marketplace, a Russian cybercrime forum listing called Nexus, launched in late August.
Security journalist Brian Krebs discovered Nexus on August 31 after its operator offered up Krebs's own Virginia driver's license as a free sample to prove the service worked. Krebs reported that licenses belonging to Defense Secretary Pete Hegseth and an FBI assistant director are also available through the service. And in a sign the underlying breach may still be ongoing, Nexus added roughly 400,000 new records in the 24 hours after Krebs first wrote about it.
Beyond the 153 million driver's licenses, Nexus is selling more than 10 million identification cards, nearly 2 million travel documents, and more than 579,000 medical cards, along with marijuana dispensary membership cards. The listings include high-resolution scans captured under infrared and ultraviolet light (imaging businesses use to check whether an ID is genuine), along with timestamps and, in some cases, photos of the customers who submitted them.
IDScan.net's Jillian Kossman told Krebs that the company isn't able to share additional information but called his reporting "welcome, and helpful to our team's investigation." Hertz did not respond to a request for comment before Krebs' publication.
The type of data found in this breach is a boon for identity thieves. Larry Baldwin, a principal intelligence researcher at cybersecurity firm Cybera, warned that a stolen driver's license scan is enough to open a fraudulent credit line in someone else's name. More concerning, he also cautioned that the same data can be used to identify people in witness protection or track down domestic violence survivors who have relocated.
There's no consumer-facing lookup tool to check whether your own license is in the Nexus data, and the FBI investigation is still in its early days. If you've rented a car, checked into a hotel, bought from a dispensary, or gone through a TSA checkpoint in the past couple of years, there's a reasonable chance your license was scanned by a system like IDScan.net's. It's worth pulling your credit reports at annualcreditreport.com and watching for accounts you don't recognize. Placing a credit freeze with the three major bureaus is free and reversible if you want a stronger block against new accounts being opened in your name.
