A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million driver licenses from people in the United States and Canada. On Sept. 1, 2026, the New Orleans field office of the FBI opened an official inquiry into the source of those images.
This is not some old password dump. These are pictures of real licenses. Photo, address, date of birth, license number. The whole card. Somebody turned your government ID into inventory you never agreed to sell.
On Monday, Aug. 31, a source flagged an ad from a new user on the Russian cybercrime forum Exploit. That ad offered access to digital scans of identity documents on more than 170 million people in North America. The seller even offered the reporter’s own Virginia record, which is how this got noticed so fast.
The scans look like they came from a Louisiana ID checker
People whose licenses showed up for sale were interviewed for this reporting. The images appear to be siphoned from a widely used identity verification company based in Louisiana.
Here is the part regular folks never get told. You hand your license to a clerk. They take a picture. That picture goes to a vendor you did not pick so they can say you are real. If that vendor gets cleaned out, your card sits on a dark web menu next to 153 million others.
That is a system that does not work. The company storing the picture has more of you than you do. You cannot opt out after the fact. You cannot call the DMV and make it un-happen.
Cabinet officials are in the pile too
One record on the service includes the driver license for U.S. Defense Secretary Pete Hegseth. He is one of several high-ranking U.S. government officials whose licenses can be found for sale.
If a Defense Secretary’s license is on the menu, yours is too. This is not a VIP problem. This is an everybody problem.
What you should do right now
You cannot unsell a scan that is already listed. You can make it a lot harder for someone to use it against you.
- Freeze your credit with Equifax, Experian, and TransUnion. It is free, and it blocks most new accounts in your name.
- Watch your bank, cards, and IRS online account for activity you did not start.
- Do not assume your state DMV got hacked. This looks like a third-party identity checker, not the state that printed the card.
- When a business wants to scan your license, ask who keeps the image and for how long. You may not get a real answer. Ask anyway.
- Treat any place that copied your license in recent years as a possible exposure, not a theoretical one.
Big systems love to call this convenience. Convenience for them. Risk for you. Your license was never supposed to be stock on a Russian crime forum.
Primary Source: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/