FBI Investigates Alleged Breach of 153 Million Driver's Licenses Linked to ID Verification Firm

The FBI is reportedly investigating a potentially massive breach of identity data affecting as many as 170 million people across North America. The breach was first uncovered by investigative journalist Brian Krebs, who found a cybercrime service called "Nexus" operating on the Exploit Russian forum, offering digital scans of driver's licenses, ID cards, travel documents and medical cards. Nexus claimed to hold over 153 million driver's licenses, mostly belonging to American and Canadian citizens, and operators said the data came from an active breach at a major identity verification company.

The Nexus service disappeared shortly after Krebs published his findings, but he was able to trace activity linked to his own identity and other victims back to New Orleans-based identity verification provider IDScan.net, which says it is now investigating the matter.

Security experts warn the incident could have long-lasting consequences. A driver's license contains enough personal data—including date of birth, address and physical descriptors—to pass many identity verification checks used by banks and government agencies. Unlike a password, this information cannot be changed, meaning affected individuals may carry the exposure indefinitely. Experts are calling on organizations that collect and store government ID documents to apply security standards on par with, or exceeding, those used for payment card data.