A criminal marketplace is reportedly offering more than 153 million driver’s license records from the United States and Canada. A cybersecurity journalist found his own license inside it. Here’s what’s actually confirmed, what’s still unproven, and the practical steps to take right now.
153 Million Driver’s License Records Exposed — What To Do Now
153 Million Driver’s License Records Reportedly Exposed: What’s Confirmed and What to Do
More than 153 million driver’s license records are reportedly being offered through a dark web identity theft service. That figure comes from the operators of the criminal marketplace itself, not from an independent audit — and investigators still don’t know how many of those records are duplicates, expired documents, or repeat scans of the same person.
That distinction matters. But the evidence that has already been verified is serious enough to take practical steps now, even before every detail is settled.
What the Marketplace Claimed
A cybersecurity journalist reported that a dark web service called Nexus was advertising a large collection of identity documents from the United States and Canada. Nexus claimed more than 153 million driver’s license records, plus millions of other identification cards, travel documents, and medical cards.
It was also reported that the FBI’s New Orleans field office opened an inquiry into the apparent breach.
The Evidence Behind the Claim
The strongest evidence here isn’t just a number posted by criminals. The journalist found his own Virginia driver’s license inside the service. His record included images of the front and back of the card under normal, infrared, and ultraviolet light, each with a timestamp attached.
He then searched, with permission, for more than a dozen friends and relatives and found nine of them. All nine of those records had timestamps that lined up with travel on or near those dates, and several connected to vehicle rentals.
That gives this story an unusual trail. These are not simply lists of names and license numbers. Some records contain the specialized images created by professional authentication equipment — the kind used to inspect security features that an ordinary camera can’t see. The very technology meant to tell a real license from a fake one may have produced some of the most sensitive material now under investigation.
The Verification Company Behind the Records
Reporting points toward IDScan.net, a Louisiana identity verification company used behind the scenes by other businesses. The final source and scope of the exposure have not been established, and IDScan.net has said it is investigating and hasn’t reached conclusions about whether unauthorized access occurred or what information was involved.
So it’s too early to say the company supplied every Nexus record, or that every customer of a business using its tools was exposed. Still, the connections deserve attention. The reporter said his license and his mother’s license had timestamps seconds apart — the two had handed both licenses to a Hertz representative at the same time. Another researcher found his scan tied to a Las Vegas trip and recalled that a Planet 13 dispensary had scanned his ID; IDScan.net had publicly announced in 2022 that Planet 13 used its VeriScan technology at 16 Las Vegas check-in stations.
The scale involved helps explain the concern. IDScan.net says its products perform more than 21 million verifications each month at more than 20,000 locations worldwide. Its current privacy policy says client data has historically included identifiers, transaction information, device information, and location data — and may also include government ID data and biometric data.
Why More Verification Can Mean More Risk
There’s a legitimate reason these systems exist. Rental companies must verify that a customer can legally drive. Banks and other regulated businesses may have identity requirements. Age-restricted stores need to prevent unlawful sales. IDScan.net’s own fraud report says it analyzed more than 150 million scans from 2024 and found that stronger checks — including infrared and ultraviolet imaging — caught fraudulent documents that simpler barcode checks could miss.
But that creates a difficult trade-off. Better authentication can reduce fraud at the counter while creating a richer target behind the counter. Think about two businesses that both check your age: one employee looks at your card and hands it back, while another system creates front and back images, reads the barcode, checks hidden security features, and may retain information connected to the visit. Both verify the same person, but the amount of data at risk is very different. That’s why companies need to ask not just whether collecting the data helps, but how much they actually need and how long they keep it.
153 Million Records vs. 240 Million Drivers
Now compare the headline number with the size of the driving population. Federal Highway Administration data shows about 240 million licensed drivers in the United States in 2024. If 153 million records represented unique American drivers, that would equal roughly 64% of that total.
But Nexus included Canadian records too, and a single person could easily appear in the collection more than once. A record count is not a victim count.
The marketplace also claimed it had been collecting new data for more than a year, and one journalist observed the listed driver’s license total rise by nearly 400,000 in about 24 hours. Those claims haven’t been independently proven. Nexus later disappeared from the dark web after the reporting was published — but taking down a storefront doesn’t erase copies that may already exist elsewhere.
What a Stolen License Scan Can (and Can’t) Do
A typical license shows your legal name, photograph, address, birth date, license number, expiration date, and physical description, and the barcode can carry structured data too. A convincing copy of that information could support impersonation, targeted phishing, or an attempt to open an account in your name.
But don’t assume every secret in your financial life was included. Current public reporting hasn’t established that Social Security numbers, bank passwords, or payment card numbers were part of this collection. A stolen license image is serious, but it isn’t proof that someone can immediately get into your bank account.
Steps to Protect Yourself Right Now
The first practical step is to be suspicious of anyone offering an instant breach check. There is no confirmed public list of affected people and no official lookup tool for this incident. Don’t send another license image, your Social Security number, a password, or banking information to an unsolicited website, email, or text message.
Next, consider freezing your credit with Equifax, Experian, and TransUnion. A freeze is free, doesn’t lower your credit score, and makes it harder for someone to open a new credit account in your name. You have to contact all three bureaus separately, and you can temporarily lift a freeze when you legitimately apply for credit yourself.
Also review your credit reports at AnnualCreditReport.com — federal guidance says online reports are available weekly for free — and look for accounts or debts you don’t recognize. A fraud alert is another free option: it tells businesses to verify your identity before opening new credit, lasts one year, and requires contacting only one of the three bureaus, since that bureau must notify the other two.
If You Think Your License Was Exposed
If you believe your license information was exposed, contact your state motor vehicle agency and ask what it recommends. The agency might flag the license number or suggest a duplicate, depending on the state — but don’t assume that simply buying a replacement card automatically changes the number or removes the risk. Ask first.
Keep watching your existing financial accounts, since a credit freeze mainly protects against new credit being opened in your name. Save any incident notice, rental agreement, receipt, or email showing when and where your ID was scanned. And if an unfamiliar loan, account, or transaction appears, report the identity theft through IdentityTheft.gov and follow the recovery plan it creates.
The Bigger Data Question
The central problem here is bigger than one dark web listing. You can use strong passwords and multi-factor authentication and still lose control of an identity document through a vendor you never knew was involved. A license that once passed briefly across a counter can now become a lasting digital record moving through scanners, software, and databases.
So the headline here isn’t 153 million confirmed victims. It’s a warning about how much verified identity data can gather behind ordinary transactions, and how little visibility consumers may have into where it goes. The next time you hand over your license, it’s worth asking whether it’s being viewed, scanned, or stored.
Frequently Asked Questions
Is it confirmed that 153 million people had their driver’s license stolen?
No. The 153 million figure is a record count claimed by the operators of a criminal marketplace, not an independently verified victim count. It likely includes duplicates, expired documents, and repeat scans of the same people.
What is IDScan.net, and are they confirmed as the source?
IDScan.net is a Louisiana identity verification company whose technology is used by rental companies, dispensaries, and other businesses. Reporting points toward it, but the final source and full scope of the exposure have not been established, and IDScan.net says its investigation is ongoing.
Was my Social Security number exposed too?
Current public reporting has not established that Social Security numbers, bank passwords, or payment card numbers were part of this collection. That doesn’t mean it’s impossible, only that it hasn’t been confirmed.
Is there an official website where I can check if I was affected?
No. There is no confirmed public list of affected people and no official lookup tool for this incident. Be suspicious of any site or message that offers an instant breach check and asks for personal information.
Does freezing my credit protect against this specific breach?
A credit freeze mainly protects against someone opening new credit accounts in your name. It doesn’t undo the exposure of a license image itself, but it’s a free, effective way to reduce the most common way stolen identity data turns into financial harm.
Should I get a new driver’s license number?
Contact your state motor vehicle agency and ask. Some states can flag a number or issue a duplicate under certain circumstances, but a replacement card doesn’t automatically get a new number, so it’s worth asking before assuming a new card solves the problem.
Key Takeaway
A criminal marketplace claimed more than 153 million driver’s license records, and independent evidence — including a reporter finding his own license inside the service — shows the claim isn’t empty. But a record count claimed by criminals is not the same as a confirmed victim count, and important details about the source and scope are still unresolved.
What you can control is how you respond. Be skeptical of instant breach-check offers, freeze your credit with all three bureaus, check your credit reports for free, and contact your state DMV if you believe your license was involved. Those steps help regardless of exactly how many records turn out to be real.
Money Instructor provides educational information only and does not offer legal, financial, or cybersecurity advice. Details of this reported breach may change as the investigation continues. Please verify current information with official sources, your state motor vehicle agency, and the credit bureaus, and consult a qualified professional before making decisions based on this article.
