Industry News

Dark Web Service Selling 153 Million US and Canadian Drivers Licenses, FBI Investigating

Krebs on Security · 2 Sept 2026
Key Takeaway Businesses that rely on third-party identity verification services should confirm how those vendors store and protect scanned ID documents, and limit retention of such data wherever possible.

A newly launched dark web service called Nexus is offering digital scans of over 153 million drivers licenses from people in the United States and Canada, along with millions of ID cards, travel documents and medical cards. Security researcher Brian Krebs reports that the data appears to have been siphoned from a widely-used identity verification company based in Louisiana, and that the FBI's New Orleans field office has opened an official inquiry into the source of the leaked images.

The scale of the leak is significant: a blank search on the service reportedly returns roughly 11.5 million pages of results, with documents spanning both countries and including drivers licenses belonging to high-ranking government officials. Some records are also tagged with sources suggesting they include commercial drivers licenses and Common Access Cards, which are used to grant physical access to secure government facilities.

While the investigation is ongoing and the full scope of affected individuals and organisations is not yet clear, this incident highlights how a breach at a single identity verification provider can expose personal documents on a massive scale, well beyond the company's own customers.

Carrying this risk through a supplier? Assessing third-party and supply chain security ->

Summarised by CISO AI from Krebs on Security. We link back to every original so you can read it yourself.