FBI Probes Leak of 153 Million License Scans

The FBI says it is investigating a report that scans of more than 153 million US and Canadian driver's licenses were put up for sale on the dark web.

The listings appeared on a criminal service called Nexus, which sold the images to anyone willing to pay. The site has since gone offline.

If you have ever photographed your license to rent a car, verify your age, or open an account, this is a story about your ID.

What Is Confirmed

The FBI confirmed to Reuters that it is investigating the reported exposure. Reporting places the probe with the bureau's New Orleans cyber division.

The Nexus listing existed and was substantial: more than 153 million driver's licenses, about 10 million ID cards, roughly 3 million travel documents and international IDs, and some 579,000 medical cards, according to the reporting compiled by Engadget and TechCrunch.

Each record reportedly carried front-and-back scans along with the infrared and ultraviolet images that ID-verification systems use to test whether a document is genuine — the kind of imagery a consumer never keeps, and only a verification vendor would hold.

Cybersecurity journalist Brian Krebs, who first surfaced the service, reported that Nexus added roughly 400,000 new records in a single 24-hour stretch. Nexus went dark shortly after his report; its login page now says the service is unavailable.

What Is Only Claimed

Nobody has proven where the images came from.

Reporting points at IDScan, a Louisiana-based identity-verification company that says it processes more than 21 million identity checks a month at over 20,000 locations, with clients including Hertz, Target, FedEx and Caesars Entertainment.

That link is not confirmed. IDScan's chief operating officer told Krebs the company is investigating but has not confirmed any breach. TechCrunch framed its own account carefully — that it "sure looks like" a major ID card verification service was breached, not that one has been established.

Until the FBI or the company says otherwise, treat the source of the data as an open question.