Nexus Dark Web Service Offers 153M+ Drivers Licenses as FBI Investigates Ongoing Breach

The service, advertised on the Russian cybercrime forum Exploit, offers not only driver's licenses but also over 10 million identification cards, more than three million travel documents, and at least 579,000 medical cards. A quick search of the database returns approximately 11.5 million pages of results, with the bulk of records belonging to Americans. The number of driver's license records increased by nearly 400,000 in just 24 hours, indicating ongoing data theft.

The records include those of high-ranking U.S. government officials, including Defense Secretary Pete Hegseth. The service's operators claim they have been "continuously exfiltrating new data for over a year into our private database" and allow customers to preview records with sensitive information redacted before purchase.

The source of the breach appears to be a widely-used identity verification company based in Louisiana. The KrebsOnSecurity reporter who broke the story was alerted to the service after his own Virginia driver's license was offered as a free sample. The FBI's New Orleans field office has formally opened an inquiry into the source of the images.

Some records are labeled with source codes such as "CDL" (commercial driver's license) and "CAC" (Common Access Card, used for physical access to government buildings), raising concerns about the breadth of the breach. The service's operators have not identified the compromised company, and the investigation is ongoing.

Why This Matters

Massive scale of exposure: Over 153 million driver's licenses, combined with medical and government access cards, puts millions of individuals at risk of identity theft, fraud, and physical security breaches.
Ongoing risk: The service is actively adding new records, meaning the breach is not contained and victims may continue to be added.
Government officials targeted: The inclusion of high-ranking officials highlights vulnerabilities in identity verification systems used by both public and private sectors.

Background

Nexus is a newly launched identity theft service on the dark web, promoted on the Exploit forum. It claims to have been harvesting data from a major identity verification company for over a year. Identity verification companies collect scans of driver's licenses and other documents to authenticate users for banks, employers, and government agencies. A breach of such a provider can expose sensitive personal data for millions. The FBI's involvement signals the severity of the incident, though the compromised company has not been publicly named.

Key Perspectives

Victims: Individuals whose licenses are for sale face potential identity theft, fraudulent accounts opened in their names, and misuse of personal information. Government officials face additional security risks. Law enforcement (FBI New Orleans): Investigating the source of the breach and working to identify the perpetrators. The inquiry may lead to takedowns or arrests, but dark web services are difficult to dismantle. The compromised identity verification company: Likely under pressure to disclose the breach and notify affected customers. Failure to act could result in regulatory fines and lawsuits. Cybercriminals: The operators see a lucrative market for stolen identity data, with potential profits from direct sales and follow-on fraud.

What to Watch

Whether the identity verification company is named and confirms the breach.
The number of records on Nexus continues to grow; monitor for any slowdown or cessation.
Law enforcement actions: possible domain seizures, arrests, or indictments.
Regulatory responses and potential class-action lawsuits against the compromised company.

ZOTPAPER