FBI investigates a dark-web stall selling 153 million North American licence scans

The FBI said on 2 September it is looking into a report that tens of millions of U.S. and Canadian driver licences are being sold on the dark web. The bureau would not add detail. The public file sits in two places: a Reuters statement from headquarters and a longer investigation by Brian Krebs.

Krebs wrote that a new service called Nexus appeared on the Russian forum Exploit on 31 August. The operator claimed more than 170 million identity documents. On the site itself a blank search returned about 153 million driver licences, more than 10 million other identity cards, more than 3 million travel documents and about 580,000 medical cards. Roughly 1.1 million of the licences were Canadian, including more than 473,000 from Ontario. The rest appeared to be American. The seller used Krebs own Virginia licence as a free sample.

Where the scans likely came from

Nexus told buyers the feed was live and that about 500,000 new documents arrived each day from a major identity-verification firm. Krebs traced the images to IDScan.net, a Louisiana company whose software is used in bars, cannabis shops, car-rental desks and other counters that photocopy an ID and check it against a template. He confirmed nine licences with the people named on them. During the reporting he was added to a call with FBI cyber officials. They told him the New Orleans field office had opened a case on an apparent breach of that firm.

IDScan had not issued a public statement when SecurityWeek and TechCrunch followed the story on 2 and 3 September. Nexus went dark after Krebs published. That does not retire the copies. Once licence photographs and barcodes are on a forum, they can be resold in bulk even if the original stall closes.

Why the photographs matter more than the numbers

A leaked date of birth is one problem. A leaked face plus an address plus a document number is a different problem. Domestic-violence survivors, witnesses and anyone who moved to hide a location now have to assume that an old licence image is for sale. Banks and airlines that accept a scanned licence as a second factor have to assume that the scan is no longer scarce.

The timing is awkward for governments that are rolling out age-check laws. Those laws push websites to collect the same class of document that just appeared in a criminal catalogue. If the pipeline is a vendor like IDScan, the collection point is not the website. It is the contractor that stores the picture.

Krebs also wrote that Nexus listed the licence of an FBI assistant director. He did not find Director Kash Patel in the set. That detail is why New Orleans, rather than a generic cyber squad, is on the file. It is also why the one-line FBI statement exists at all.

No government has yet told licence holders to replace their cards. Until IDScan or a state motor-vehicle agency publishes a notice, the practical step for a reader is the dull one: freeze credit files, treat unexpected KYC requests as hostile, and assume that a bar or rental desk that copied a licence this year may have copied it into a database that did not stay closed.