If You Rented a Car or Bought Weed Recently, Your License Is Likely for Sale on the Dark Web. Protect Your Identity Now

When security reporter Brian Krebs found his own Virginia driver's license for sale on the dark web, the timestamp told him exactly where it had come from: the Hertz counter where he and his mother had handed over their IDs. Her license showed up seconds later in the same batch. Privacy researcher Zach Edwards found his license too, timestamped to a Las Vegas dispensary that scanned it at the door.

Their licenses are two of more than 153 million that a dark web identity theft service claims to be selling, belonging to people across the United States and Canada. Some records reportedly include the infrared and ultraviolet scans used to verify that an ID is genuine, giving criminals more than a photograph and license number.^[1]

The FBI has opened an investigation into the apparent breach, but the licenses were already available to purchase. If yours is among them, replacing the card may only solve part of the problem.

What was exposed in the driver’s license leak?

The service, called Nexus, appeared on the Russian cybercrime forum Exploit on August 31.

Its operator claimed to possess identity documents belonging to more than 170 million North Americans, according to KrebsOnSecurity.

The collection allegedly includes:

• More than 153 million driver’s licenses
• More than 10 million identification cards
• More than 3 million travel documents or international IDs
• At least 579,000 medical cards

Approximately 1.1 million of the driver’s licenses reportedly belong to Canadians, including nearly 474,000 people in Ontario. Most of the exposed records appear to belong to Americans.

Nexus has not provided independent proof of every number it advertises. However, KrebsOnSecurity found approximately 11.5 million pages of driver’s license results, with about 15 records displayed on each page. The number of available licenses also increased by nearly 400,000 in 24 hours, suggesting that the people behind the service may still have been collecting data.

The dark web site disappeared shortly after Krebs published his report. That removes one place where the records were being sold, but it cannot recover documents that criminals may have already purchased or copied.

More than ordinary photos

Some Nexus records reportedly contain six separate image files: basic scans of the front and back of a license, plus infrared and ultraviolet versions of both sides.

ID-verification systems use different wavelengths of light to inspect security features that are difficult to see in a normal photograph. A criminal equipped with those images may have more information to help imitate a legitimate document or defeat remote identity checks.

The timestamps on Krebs's and Edwards's records point toward a common source. Both moments involved a business scanning a license through third-party identity-verification technology, and Edwards traced his to a dispensary using IDScan.net.

IDScan.net says its technology performs more than 21 million identity verifications per month across over 20,000 locations. Its website lists major companies, including Hertz, Target, FedEx, Caesars Entertainment, and Motorola Solutions, among its customers.

The company confirmed that it was investigating, but it did not find that its systems were breached or provide a detailed explanation. The FBI’s New Orleans field office has opened an official investigation into an apparent breach involving IDScan.net.

Until that investigation is complete, the precise source and full scope of the exposed data remain unconfirmed.

One leaked license, one problem that never goes away

A password can be changed within minutes. Your face, birth date, address history, signature, and physical characteristics are far harder to replace.

Driver’s licenses are widely accepted as proof of identity when someone applies for credit, rents property, opens an account, collects a package, or completes an age check. A high-quality image of both sides can give a criminal many of the details needed to impersonate its owner.

The exposed documents could be used for:

• Opening fraudulent credit or utility accounts
• Passing automated identity-verification checks
• Creating convincing counterfeit IDs
• Taking over existing accounts
• Conducting targeted phishing attacks
• Hiding another person’s identity behind yours

The database may pose an especially serious danger to domestic violence survivors, people in witness protection, public officials, and anyone else whose home address or identity must remain private.

One license may pass through hotels, rental agencies, bars, dispensaries, financial services, and age-verification platforms, creating multiple copies that the owner cannot see, control, or delete.

How to protect your identity now

The report mentions no official public lookup tool that can tell you whether your license appears in Nexus. With a database this large, taking precautions may be safer than waiting for a notification.

Freeze your credit

A credit freeze prevents prospective lenders from accessing your credit file, making it much harder for criminals to open new accounts in your name.

You must contact Equifax, Experian, and TransUnion separately. Freezing and temporarily lifting your credit are free, and a freeze does not affect your credit score.

You can also place a free fraud alert by contacting any one of the three bureaus. That bureau must notify the other two. The alert tells businesses to take additional steps to verify your identity before granting credit.

Review your credit reports

Visit AnnualCreditReport.com to obtain free credit reports from all three major bureaus. Review them for unfamiliar accounts, addresses, hard inquiries, or debts.

AnnualCreditReport.com is the federally authorized source for free credit reports. Be careful with look-alike websites, especially ones that request payment or try to enroll you in a subscription.

Watch your existing accounts

A credit freeze primarily blocks new credit. It cannot stop someone from misusing an account that is already open.

Turn on alerts for bank withdrawals, credit card purchases, password changes, and new sign-ins. Review statements closely, and contact the company immediately if you see activity you do not recognize.

Protect your email and mobile carrier accounts with unique passwords and multi-factor authentication. A carrier account PIN can also make it harder for a criminal to transfer your phone number and intercept security codes.

Report suspected identity theft

If someone has already used your information, report it through IdentityTheft.gov. The Federal Trade Commission will create a personalized recovery plan and an identity theft report that can help you dispute fraudulent accounts.

You should also contact your state’s motor vehicle agency if your license number or image has been compromised. Ask whether the agency can flag the license, issue a replacement number, or add additional protections to your record. Procedures vary by state.

Canadians should review their files with Equifax Canada and TransUnion Canada, report compromised government identification to the appropriate provincial agency, and report suspected fraud to the Canadian Anti-Fraud Centre.

The bottom line

The apparent theft of 153 million driver’s licenses shows what happens when identity-verification companies accumulate enormous collections of permanent personal data. Businesses may scan your license for a transaction lasting minutes, while the resulting images can remain stored for years.

The FBI investigation may eventually establish where the records came from and how they escaped. That will not make the information private again.

Freeze your credit, inspect your reports, enable account alerts, and treat unexpected requests involving your identity with suspicion. Criminals may already possess a convincing copy of the document many companies rely on to prove that you are you.