Seller Advertises 153 Million U.S. and Canadian Driver’s License Scans

More than 153 million scans of U.S. and Canadian driver’s licenses are being advertised for sale on the dark web, according to reporting by Boing Boing that cites KrebsOnSecurity. The apparent collection also includes more than 10 million identity cards, over 3 million travel documents or foreign IDs, and at least 579,000 medical cards. The documents were reportedly posted by a new user on Exploit, a Russian-language cybercrime forum. The FBI is investigating where the images came from. The seller has not publicly identified the identity verification company allegedly connected to the records, and no provider has announced that it suffered a breach. KrebsOnSecurity reportedly examined listings on the Nexus marketplace and found results involving people in both Canada and the United States. A search without specific parameters returned approximately 11.5 million pages, with about 15 results per page, while a search for Canadian driver’s licenses produced roughly 1.1 million results. Ontario was described as having the largest concentration of those records, with 473,673 listings. Those marketplace figures were presented as an informal check on the seller’s claim, not as an independent confirmation of the total number of documents. The source material also does not establish whether all of the advertised records are genuine, newly obtained, or connected to one breach. KrebsOnSecurity’s own informal investigation identified idscan.net as a company that provides related identity-verification services to some retailers and other businesses associated with people whose information appeared in the exposed data. However, the reporting does not establish that idscan.net was the source of the files. The company named in the investigation has not been confirmed as responsible, and the FBI inquiry remains ongoing.