FBI investigates theft of 153M driver’s licenses

The digital scans of millions of driver’s licenses were being sold on the dark web, and the FBI launched an investigation.

More than 153 million licenses from the U.S. and Canada were found on the dark web, according to the digital security blog KrebsOnSecurity.

Brian Krebs reported on his website that the data came from a “widely-used identity verification company based in Louisiana.”

He was initially alerted to a user on the Russian cybercrime forum Exploit advertising digital scans of documents from 170 million people in North America by Nexus. One of the documents offered was Krebs’s own Virginia driver’s license.

Story continues below Trending Shorts

In addition to the 153 million licenses, there were another 10 million identification cards, three million travel documents and/or international IDs, and 579,000 medical cards, Krebs reported.

The FBI confirmed that it was investigating the reports, saying simply it was “looking into the incident,” but could not comment “due to the ongoing nature of the investigation,” Reuters reported.

It may be the largest exposure of government-issued identity documentation.

Threat researcher from Infoblox, Zach Edwards, said, “There’s never been a breach of driver’s licenses at this scale,” adding that the ongoing nature of the breach “means that this attack created legitimate national security risks for high-profile individuals.”

Edwards’ documentation was also allegedly found, Reuters reported.

So was Secretary of Defense Pete Hegseth, according to KrebsOnSecurity.

While Reuters could not pinpoint where the data came from, Krebs said a representative from identity verification provider IDScan.net was investigating.

Marketing and operations leader Jillian Kossman told Krebs in an email, “At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation.”

Companies and agencies that use IDScan.net include Hertz, Target, GameStop, the U.S. Coast Guard, FedEx, Waste Management and more than 1,900 marijuana dispensaries, including Planet13, Krebs discovered.

Krebs said shortly after the story was posted, Nexus disappeared from the dark web with the message “This service is no longer available.”

What can you do if your driver’s license information has been taken?

The Federal Trade Commission said that if you have been a victim of a data breach, check, freeze, or monitor your credit.

For driver’s licenses specifically, contact your nearest DMV to report it. If you have been the victim of fraud or a scam related to the breach, report it to the FTC.

©2026 Cox Media Group