FBI Investigates Reported Sale of Millions of Driver's Licenses on Dark Web

By douglasharrington // 2026-09-04

Mastodon

Parler

Gab

Copy

The Federal Bureau of Investigation (FBI) said Wednesday, Sept. 2, that it is investigating a report that tens of millions of driver’s licenses belonging to people in the U.S. and Canada were being sold on the dark web. In a brief statement, the bureau said it was “looking into the incident” but could not comment “due to the ongoing nature of the investigation,” according to officials. The probe follows a report by independent journalist Brian Krebs, who said he discovered a website offering digital scans of millions of driver’s licenses from the U.S. and Canada. The report states that Krebs confirmed the authenticity of the data being sold with nine individuals before publishing his findings on Tuesday, Sept. 1 ^[1].

Discovery of Dark Web Site

According to the report by Krebs, he was alerted to the site, which he said was advertised on a Russian cybercrime forum. The report states that Krebs’s own driver’s license was offered as a free sample to promote the service. Krebs identified the service as "Nexus," which he said claimed to hold tens of millions of licenses for people in the U.S. and Canada, as well as millions of other identification cards and travel documents and hundreds of thousands of medical records ^[1]. The report states that the site appeared to be updating its database of stolen data in real time, indicating that it was being fed by a live breach. This aspect of the ongoing breach has raised particular concern among security researchers, according to the reports. The exact source of the data has not been established, and authorities have not confirmed where it originated.

Scope of Compromised Data

The breach, if confirmed, could be one of the largest exposures of government-issued identity documents in North America – creating risks of identity theft and fraud for tens of millions of people, according to the report. Security researcher Zach Edwards of the cybersecurity company Infoblox stated the incident was unprecedented in terms of its scope. "There's never been a breach of driver's licenses at this scale," said Edwards, according to the report ^[1]. The report quotes Edwards as saying the ongoing nature of the breach "means that this attack created legitimate national security risks for high-profile individuals." The potential for identity theft is significant, as driver’s licenses are a primary form of identification used for financial transactions and various verification processes, according to Krebs' reporting ^[1].

Expert Assessment and Potential Risks

The report states that Krebs quoted a representative of New Orleans-based identity verification provider IDScan.net as saying that it was investigating the matter. IDScan.net, which describes itself as providing "ID fraud prevention at scale," did not return repeated messages from Reuters seeking comment, according to the dispatch. The vast aggregation of personal identity documents by private companies creates a significant target for malicious actors. Cybersecurity experts have long pointed to the risks associated with centralized data collection. The potential fallout from this incident includes not only financial fraud but also more complex schemes, as the stolen data can be used to bypass security measures that rely on identity verification ^[2].

Investigation Status and Response

Authorities have not released further details about the timeline or potential sources of the breach, according to the report. The FBI’s brief statement did not specify whether the bureau believes the data was obtained through a direct hack of a government agency or through a private sector company, according to officials. Krebs reported that the dark web site offering the driver’s license data vanished shortly after he published his report. The disappearance of the site complicates the investigation, according to experts. Federal authorities have not confirmed whether the site’s takedown was a result of law enforcement action or a move by the operators. The investigation into what could be one of the largest compromises of identity data remains active, according to the FBI's statement ^[1].

Conclusion

The reported sale of tens of millions of driver’s licenses on the dark web represents a potential major breach of personal data across North America, according to Krebs's reporting. The FBI has confirmed it is investigating the incident, but authorities have not yet identified the source of the breach or the operators of the dark web site ^[1]. The scale of the potential data exposure, if confirmed, presents a significant challenge for individuals and institutions alike. The incident underscores the risks associated with the widespread collection and storage of personal identification documents by private companies. As the investigation continues, experts are likely to focus on the methods used in the breach and the potential for the misused data to facilitate further criminal activity ^[3].

References

TechCrunch. "It sure looks like hackers breached a major ID card verification service". September 2, 2026.
Greenberg, Ivan. "The dangers of dissent the FBI and civil liberties since 1965".
Mike Adams. "Mike Adams interview with Devlin". November 26, 2024.

Explainer Infographic