Digital ID Nightmare: 170 Million Americans’ and Canadians’ Identity Documents Stolen, Sold on Dark Web
by Frank Bergman
A massive trove of more than 170 million Americans’ and Canadians’ sensitive identity documents has surfaced for sale on the dark web, sounding the alarm over the growing push for centralized digital ID and online identity-verification systems.
The staggering database includes scans of more than 153 million driver’s licenses.
It also contains 10 million ID cards, more than three million travel documents, and over half a million medical cards.
Even President Donald Trump’s Defense Secretary Pete Hegseth was exposed.
An assistant director of the FBI was also reportedly among the victims.
The enormous collection of personal identification documents was being sold through a dark web service called “Nexus.”
Cybersecurity journalist Brian Krebs uncovered the operation after the stolen records appeared on a Russian cybercrime forum.
The breach represents a chilling demonstration of the danger created when millions of citizens are required to hand over their most sensitive identity documents to centralized verification services.
And the threat is becoming increasingly urgent as politicians push to expand digital identification and age-verification requirements across the Internet.
153 Million Driver’s Licenses Exposed
The scale of the exposed database is extraordinary.
Nexus contained more than 153 million driver’s license scans from the United States and Canada.
Combined with the other compromised documents, the database contained records covering more than 170 million people.
Before disappearing from the dark web, Nexus allowed customers to search through the enormous collection of identity documents.
The people behind the operation openly boasted that they had been siphoning off information for more than a year.
“We have been continuously exfiltrating new data for over a year into our private database,” Nexus stated on the Russian forum.
“Records are available to preview before purchase with pertinent information redacted.
“Customer photos are displayed if available.”
The criminals claimed their source was a “major identity verification company” that works with several Fortune 500 corporations.
Krebs was given compelling evidence that the database was genuine.
The person controlling the files produced a scan of Krebs’ own Virginia driver’s license.
Krebs then discovered his mother’s license in the system.
The timestamps on the two documents were separated by only seconds.
ID Scans Traced to Verification Network
That timing provided an important clue.
Krebs and his mother had handed their driver’s licenses to a Hertz representative at the same time.
“I was able to find my mother’s driver’s license in this service as well, and the timestamps for her images are just a few seconds apart from mine,” Krebs wrote.