FBI Investigates Massive Breach Exposing Millions of U.S. Driver’s Licenses
The FBI is probing a potential data breach that may have compromised scans of millions of American driver’s licenses, raising alarms about identity fraud and national security risks. The investigation, confirmed by a bureau spokesperson, follows reports that criminals are selling access to over 160 million North American driver’s licenses along with 10 million additional documents, including residency cards, medical IDs, and international identity records via a service called Nexus on the Russian-language cybercrime forum Exploit.
The breach appears linked to a major identity verification company, with the sellers claiming persistent access to its systems and those of its Fortune 500 clients. Cybersecurity researcher Zach Edwards, whose own ID was found in the cache, warned that if confirmed, the leak could rank among the largest exposures of U.S. government-issued identity documents. Edwards, of Infoblox, noted the operation appears ongoing, with new credentials still being stolen, posing risks for high-profile individuals.
Independent journalist Brian Krebs verified the authenticity of some documents by confirming details with nine affected individuals. The Nexus service went offline shortly after news of the FBI’s investigation broke.
The incident underscores a growing trend of identity document breaches fueling enterprise fraud, as stolen but authentic IDs make it harder for banks and institutions to verify identities. Earlier this year, Wisconsin officials revealed a Conduent breach affecting 25 million Americans, exposing Social Security numbers and health data, while Citizens Bank and Frost Bank disclosed a third-party breach tied to the Everest ransomware gang, highlighting the escalating risks of vendor-based cyber threats.
Conduent TPRM report: https://www.rankiteo.com/company/conduent
"id": "con1788525092",
"linkid": "conduent",
"type": "Breach",
"date": "9/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Millions of individuals, '
'Fortune 500 clients',
'industry': 'Technology, Identity Verification',
'location': 'United States',
'name': 'Identity verification company (unnamed)',
'type': 'Identity Verification Service Provider'},
{'industry': 'Various',
'location': 'United States',
'name': 'Fortune 500 clients (unnamed)',
'size': 'Large',
'type': 'Corporations'},
{'customers_affected': '25 million Americans (earlier '
'breach)',
'industry': 'Technology, Government Services',
'location': 'United States',
'name': 'Conduent',
'size': 'Large',
'type': 'Business Process Services'},
{'industry': 'Banking',
'location': 'United States',
'name': 'Citizens Bank',
'size': 'Large',
'type': 'Financial Institution'},
{'industry': 'Banking',
'location': 'United States',
'name': 'Frost Bank',
'size': 'Large',
'type': 'Financial Institution'}],
'attack_vector': 'Third-party vendor compromise',
'data_breach': {'data_exfiltration': 'Yes (sold on dark web via Nexus '
'service)',
'file_types_exposed': 'Scans of identity documents',
'number_of_records_exposed': '170 million (160M driver’s '
'licenses + 10M additional '
'documents)',
'personally_identifiable_information': 'Yes (driver’s license '
'details, medical IDs, '
'residency cards)',
'sensitivity_of_data': 'High (government-issued IDs, '
'personally identifiable information)',
'type_of_data_compromised': 'Driver’s licenses, residency '
'cards, medical IDs, '
'international identity records'},
'description': 'The FBI is probing a potential data breach that may have '
'compromised scans of millions of American driver’s licenses, '
'raising alarms about identity fraud and national security '
'risks. The breach appears linked to a major identity '
'verification company, with sellers claiming persistent access '
'to its systems and those of its Fortune 500 clients. The data '
'is being sold via a service called Nexus on the '
'Russian-language cybercrime forum Exploit.',
'impact': {'brand_reputation_impact': 'High (identity verification company, '
'Fortune 500 clients)',
'data_compromised': '160 million North American driver’s licenses, '
'10 million additional documents (residency '
'cards, medical IDs, international identity '
'records)',
'identity_theft_risk': 'High (millions of government-issued IDs '
'exposed)',
'legal_liabilities': 'Potential regulatory fines, legal actions',
'operational_impact': 'Ongoing identity fraud risks, challenges in '
'identity verification for banks and '
'institutions',
'systems_affected': 'Identity verification company systems, '
'Fortune 500 client systems'},
'initial_access_broker': {'backdoors_established': 'Persistent access claimed',
'data_sold_on_dark_web': 'Yes (via Nexus service on '
'Exploit forum)',
'entry_point': 'Identity verification company '
'systems',
'high_value_targets': 'Fortune 500 clients, '
'government-issued IDs'},
'investigation_status': 'Ongoing (FBI investigation)',
'lessons_learned': 'Growing trend of identity document breaches fueling '
'enterprise fraud; third-party vendor risks escalating; '
'need for enhanced identity verification measures.',
'motivation': 'Financial gain, identity fraud, enterprise fraud',
'post_incident_analysis': {'corrective_actions': 'Enhance third-party risk '
'management; implement '
'stricter access controls; '
'monitor dark web for stolen '
'data sales.',
'root_causes': 'Third-party vendor compromise, '
'inadequate security controls for '
'identity verification systems'},
'recommendations': 'Strengthen third-party vendor security assessments; '
'implement multi-factor authentication for identity '
'verification; enhance monitoring for dark web sales of '
'stolen data; improve incident response plans for '
'identity-related breaches.',
'references': [{'source': 'FBI Spokesperson'},
{'source': 'Zach Edwards (Infoblox)'},
{'source': 'Brian Krebs'},
{'source': 'Wisconsin Officials (Conduent breach)'},
{'source': 'Citizens Bank and Frost Bank Disclosures'}],
'regulatory_compliance': {'regulations_violated': 'Potential violations of '
'data protection laws '
'(e.g., GDPR, state-level '
'U.S. laws)'},
'response': {'law_enforcement_notified': 'FBI investigating'},
'threat_actor': 'Initial Access Brokers (via Nexus service on Exploit forum)',
'title': 'FBI Investigates Massive Breach Exposing Millions of U.S. Driver’s '
'Licenses',
'type': 'Data Breach'}