FBI Investigates Massive Driver's Licence Leak as 1.1 Million Canadian Records Appear on Dark Web

The FBI has opened an investigation into a potentially massive data breach after a dark web service offered digital scans of more than 153 million driver's licences belonging to people in the United States and Canada, including approximately 1.1 million Canadian licence records. The discovery is raising serious concerns about identity theft and financial fraud.

Cybersecurity journalist Brian Krebs uncovered the service, called "Nexus," after it appeared on a Russian cybercrime forum in late August. The operators claimed to hold more than 153 million driver's licences, more than 10 million identification cards, over three million travel documents or international IDs, and at least 579,000 medical cards.

Canadians appear to make up a significant portion of the database. A search limited to Canadian driver's licences returned approximately 1.1 million results, with Ontario accounting for the largest identified concentration at about 473,673 records. A complete breakdown for other Canadian provinces and territories has not been published.

The material being offered goes beyond names and licence numbers. Some records reportedly include high-quality images of both the front and back of driver's licences, along with infrared and ultraviolet scans used by identity verification systems to authenticate government-issued documents.

Krebs independently checked records belonging to nine individuals, all of whom confirmed that the documents and associated dates appeared authentic. The number of licence records listed by the service also increased by nearly 400,000 in just 24 hours, raising concerns that new information may have been continuing to enter the database when it was discovered.

The FBI's New Orleans field office is investigating an apparent breach involving identity verification company IDScan.net. The Louisiana-based company said it was investigating the matter but had not issued a detailed statement confirming that its systems were the source of the records. Reuters also reported that the ultimate source of the data had not yet been established.

Shortly after the investigation was made public, the Nexus dark web service disappeared and its login page was replaced with a message saying the service was no longer available. The site's disappearance, however, does not establish whether copies of the records had already been downloaded or distributed.

Security researchers warn that full scans of genuine driver's licences are particularly valuable to criminals because the documents are widely used to verify identities when opening accounts, applying for credit and completing online identity checks.

Canadian government guidance advises people who suspect identity theft to check their credit reports with Equifax and TransUnion, consider placing fraud alerts on their files, and report suspicious activity to their financial institution, local police and the Canadian Anti-Fraud Centre. Canadians who notice unauthorized changes or benefit applications in their CRA accounts should also report them to the Canada Revenue Agency.