Threat Intelligence

FBI Probes Alleged Sale of 153 Million Driver's License Records on Dark Web

SOCRadar · 7 Sept 2026

Key Takeaway Australian SMBs that collect or store copies of customer ID documents for verification should review retention policies and encryption practices, since large identity document caches like this one show how attractive such data is to extortion groups.

A dark web marketplace known as Nexus has advertised access to more than 153 million driver's license records from the United States and Canada, along with other identity documents including photographs, barcode data and full document scans. The exact totals, source and collection method have not been independently verified, but the FBI has reportedly opened an investigation into the claimed exposure.

Adding to the concern, the extortion group ShinyHunters publicly messaged the alleged Nexus operator, known as "databroker1", offering to purchase the full dataset, though no price was disclosed. If the records change hands, they could be redistributed, used in extortion campaigns, or combined with data from other breaches to enable identity fraud, phishing and impersonation attempts. Even if the Nexus service itself is taken down, copies held by its operator could keep the data in circulation.

Nexus also claimed to be adding roughly 500,000 new documents daily, an unverified figure that suggests the collection may be actively growing rather than a static archive. The scale and detail of the material raise broader questions about how identity verification providers store and protect government issued documents.

Summarised by CISO AI from SOCRadar. We link back to every original so you can read it yourself.