--- title: "FBI investigates 153 million drivers licenses p… | Firevault" url: https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026 description: "A dark web service claimed to be selling scans of more than 153 million drivers licenses, apparently taken from a Louisiana identity verification company used…" lang: en-GB --- News · Breach Analysis · 16 September 2026 # FBI investigates 153 million drivers licenses put up for sale on a criminal forum A dark web service claimed to be selling scans of more than 153 million drivers licenses, apparently taken from a Louisiana identity verification company used by household names. The FBI has opened an inquiry, and the case shows how long retention turns a routine check into national-scale exposure. Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Mark Fermor CTO, CMO & Founder, Firevault 4 min read Share Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffbi-investigates-153-million-drivers-licenses-dark-web-2026 Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffbi-investigates-153-million-drivers-licenses-dark-web-2026&text=FBI%20investigates%20153%20million%20drivers%20licenses%20put%20up%20for%20sale%20on%20a%20criminal%20forum%0A%0AA%20dark%20web%20service%20claimed%20to%20be%20selling%20scans%20of%20more%20than%20153%20million%20drivers%20licenses%2C%20apparently%20taken%20from%20a%20Louisiana%20identity%20verification%20company%20used%20by%20household%20names.%20The%20FBI%20has%20opened%20an%20inquiry%2C%20and%20the%20case%20shows%20how%20long%20retention%20turns%20a%20routine%20check%20into%20national-scale%20exposure. Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Ffbi-investigates-153-million-drivers-licenses-dark-web-2026 Image: Stack of driving licence cards swept by a red scan line in front of a dark server cabinet (https://fire-vault.com/news/fbi-drivers-licenses-dark-web-2026.jpg) Stack of driving licence cards swept by a red scan line in front of a dark server cabinet Why it matters ## What this means for organisations holding critical data An identity theft service advertised on a Russian cybercrime forum claimed to be selling digital scans of more than 153 million drivers licenses held by people in the United States and Canada, and the FBI has opened an official inquiry into the source of the images. The service, known as Nexus, appeared on the long-established Exploit forum at the end of August. Alongside the licenses, it claimed to hold more than 10 million identification cards, more than three million travel documents and international IDs, and at least 579,000 medical cards. The journalist Brian Krebs, whose own license was offered as a free sample in the sales thread, traced the archive to a Louisiana-based identity verification company whose customers have included FedEx and Hertz. Among the records reportedly visible in the service was the license of the United States Defense Secretary, Pete Hegseth. The FBI's New Orleans field office has since launched an investigation, and the Nexus service has apparently removed itself from the dark web. ## The common thread was a routine check Krebs found that the people he could locate in the database shared one experience: they had all hired a car from the same company. Nobody handed their license to a criminal. They handed it to a counter, an app or a scanner as part of an ordinary identity check, and the scan was kept long after the hire ended. That is the uncomfortable part of this story. The weakness was not a stolen password or an unpatched server in the victim's life. It was a decision, made by companies acting on other companies' behalf, to retain high-resolution images of identity documents (https://fire-vault.com/oss-for-identity-documents) in a connected system long after the reason for collecting them had passed. ## One connected repository, national-scale exposure A single identity verification company sits between thousands of businesses and millions of people. When that company's archive is taken, the exposure is not one customer's breach. It is everyone whose identity passed through the pipeline, assembled into a single, searchable, for-sale dataset. This is the same failure mode seen in supply chain breaches: the victim never chose the system that lost their data. The difference here is scale. One connected repository created exposure measured in nations, and the dataset will keep its value to criminals for years, as the Identity Theft Resource Center has warned. ## The service stayed online. The retained data did not have to. Verification businesses need live systems: checks happen in seconds at counters and on phones. What they do not need is years of historical scans sitting in the same connected estate, reachable by whatever path eventually fails. Retained identity documents are the definition of data that must be kept but rarely needs to be connected. Held in Offline Secure Storage (https://fire-vault.com/offline-secure-storage), on dedicated hardware that is physically disconnected when not in use, an archive of scans is not a searchable product on a criminal forum. It is a locked copy that only an approved, logged retrieval can reach. ## What organisations should take from this First, treat identity scans like the assets they are. A license image is enough to open accounts, pass checks and impersonate someone for years. Second, set a retention limit and keep it. If a scan is no longer needed for the purpose it was collected, delete it. If it must be retained, move it out of the connected estate. Third, put the question to every supplier that verifies identity on your behalf: where do the scans go, how long do they stay, and are they connected? The answer in this case appears to have been: kept for years, in a place that was reachable. Yours should be: kept briefly, and kept offline. ## Sources - TechRadar: FBI launches investigation after 153 million drivers licenses apparently leaked on Russian cybercrime forum: https://www.techradar.com/pro/security/fbi-launches-investigation-after-153-million-drivers-licenses-apparently-leaked-on-russian-cybercrime-forum - KrebsOnSecurity: FBI Probes Service Selling 153M+ Drivers Licenses: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/ - TIME: FBI Probes Possible Dark Web Sale of Over 153 Million Driver's License Scans: https://time.com/article/2026/09/03/fbi-probes-reported-dark-web-drivers-license-breach/ - Tom's Hardware: FBI investigating 153 million US and Canadian driver's licenses leaked on Russian cybercrime forum: https://www.tomshardware.com/tech-industry/cyber-security/fbi-investigating-153-million-us-and-canadian-drivers-licenses-leaked-on-russian-cybercrime-forum-including-that-of-us-secdef-pete-hegseth-data-is-suspected-to-have-come-from-an-id-authentication-service-provider About the author ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. How Firevault would handle this ## Access decided by you, not assumed by the network Control by Firevault removes standing pathways and replaces them with connection windows you approve, so stolen credentials and compromised suppliers have nothing standing to abuse. Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo **No standing access**Paths exist only when you open them **Verification**Identity confirmed before any connection is made **Containment**A compromised account cannot reach what is disconnected **Control**Every window and closure is under your command Related Reading ## You may also find these useful Breach Analysis ### ASOS data breach: stolen customer profiles and a hijacked app notification ASOS confirms customer-data exposure after attackers hijacked its app notifications. What happened, what was taken and why a stolen login can put more than contact details at risk. 12 Oct 2026 14 min https://fire-vault.com/news/asos-data-breach-customer-profiles-october-2026 Breach Analysis ### Dyfed-Powys Police confirms cyber attack as staff information may have been compromised Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The force says it has found no evidence that public data was accessed. 25 Sept 2026 3 min https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 Breach Analysis ### FBI investigates claims that hackers stole personnel and applicant data The FBI is investigating unauthorised activity affecting its recruitment website after ShinyHunters claimed it stole sensitive records on current and former personnel and job applicants. The claimed scale remains unconfirmed. 22 Sept 2026 4 min https://fire-vault.com/news/fbi-employee-applicant-data-breach-shinyhunters-2026 Breach Analysis ### Vulnerable children's health records caught up in HCRG Care Group cyber attack, families told 18 months later Families of vulnerable children in Wiltshire, Bath and North East Somerset have been told their personal health information may have been accessed in a cyber attack on HCRG Care Group in February 2025, more than 18 months after the incident. 20 Sept 2026 4 min https://fire-vault.com/news/hcrg-care-group-children-records-cyber-attack-2026 Breach Analysis ### FBI and Coast Guard board oil tankers after suspected foreign cyberattacks on ships entering US waters US authorities boarded two foreign-flagged oil tankers in the Gulf of Mexico after indications their networks were compromised by foreign cyber actors. Mark Fermor on why a ship is a floating lesson in what happens when operational technology is reachable. 17 Sept 2026 4 min https://fire-vault.com/news/fbi-coast-guard-probe-cyberattacks-oil-tankers-us-waters-2026 Breach Analysis ### CenterPoint Energy confirms hackers stole customer data through an exposed API CenterPoint Energy has confirmed that criminals stole customer data through one of its external facing systems, after a threat actor advertised 7.49 million files on a dark web forum. Mark Fermor on what an unsecured API says about the way critical infrastructure treats connected data. 16 Sept 2026 4 min https://fire-vault.com/news/centerpoint-energy-confirms-cyberattack-data-theft-2026 ## Suggested Reading - What is Offline Secure Storage The foundation of physical disconnection: https://fire-vault.com/how-it-works/offline-secure-storage - Why Offline Secure Storage The case for physical control: https://fire-vault.com/why-oss - Ransomware Defence Hold gold copies offline: https://fire-vault.com/oss-for-ransomware-recovery - Control Physical path control for IT and OT: https://fire-vault.com/solutions/control - Knowledge Vault All articles, guides and whitepapers: https://fire-vault.com/learn/knowledge - Book a Demo See Firevault in action: https://fire-vault.com/demo Back to Knowledge Vault: https://fire-vault.com/learn/knowledge ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026#webpage", "url": "https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026", "name": "FBI investigates 153 million drivers licenses p…", "description": "A dark web service claimed to be selling scans of more than 153 million drivers licenses, apparently taken from a Louisiana identity verification company used…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/news/fbi-drivers-licenses-dark-web-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "FBI investigates 153 million drivers licenses put up for sale on a criminal forum", "item": "https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "FBI investigates 153 million drivers licenses put up for sale on a criminal forum", "description": "A dark web service claimed to be selling scans of more than 153 million drivers licenses, apparently taken from a Louisiana identity verification company used by household names. The FBI has opened an inquiry, and the case shows how long retention turns a routine check into national-scale exposure.", "url": "https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/news/fbi-drivers-licenses-dark-web-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/fbi-drivers-licenses-dark-web-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/fbi-drivers-licenses-dark-web-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/news/fbi-drivers-licenses-dark-web-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-09-16T16:24:20.99349+00:00", "dateModified": "2026-09-18T05:27:07.852171+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/fbi-investigates-153-million-drivers-licenses-dark-web-2026" }, "inLanguage": "en-GB", "articleSection": "Breach Analysis", "wordCount": 675, "keywords": "Breach Analysis, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "An identity theft service advertised on a Russian cybercrime forum claimed to be selling digital scans of more than 153 million drivers licenses held by people in the United States and Canada, and the FBI has opened an official inquiry into the source of the images. The service, known as Nexus, appeared on the long-established Exploit forum at the end of August. Alongside the licenses, it claimed ", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What happened with the 153 million drivers licenses?", "acceptedAnswer": { "@type": "Answer", "text": "A dark web service called Nexus, advertised on the Russian cybercrime forum Exploit, claimed to be selling digital scans of more than 153 million drivers licenses from the United States and Canada, along with millions of other identity documents. The FBI New Orleans field office has opened an inquiry into the source of the images." } }, { "@type": "Question", "name": "Whose licenses were in the dataset?", "acceptedAnswer": { "@type": "Answer", "text": "The records reportedly included the license of the United States Defense Secretary, Pete Hegseth, and the security journalist Brian Krebs, whose own license was offered as a free sample in the sales thread on Exploit." } }, { "@type": "Question", "name": "Where did the scans come from?", "acceptedAnswer": { "@type": "Answer", "text": "The investigation by Brian Krebs traced the archive to a Louisiana-based identity verification company whose customers have included FedEx and Hertz. A common factor among the people he located in the database was that they had all hired a car from the same company." } }, { "@type": "Question", "name": "Has the Nexus service been taken down?", "acceptedAnswer": { "@type": "Answer", "text": "The service has apparently removed itself from the dark web since the story became public. However, the Identity Theft Resource Center has warned that a dataset of this size will keep its value to criminals for many years, and a similar service is likely to appear again." } }, { "@type": "Question", "name": "Why do companies keep driving licence scans?", "acceptedAnswer": { "@type": "Answer", "text": "Identity verification companies retain scans for age checks, fraud prevention and regulatory record keeping. The risk is retention without limit: once the reason for the check has passed, an archive of identity images that stays connected becomes a target rather than an asset." } }, { "@type": "Question", "name": "How can organisations reduce this risk?", "acceptedAnswer": { "@type": "Answer", "text": "Set a retention limit and delete scans that are no longer needed. Where documents must be retained, hold them in offline storage on dedicated hardware that is physically disconnected when not in use, so the archive cannot be searched, copied or sold from a distance." } } ] } ] ```