More than 150 million driver’s licenses may have been exposed in massive dark web data breach

Millions of people are thought to have been impacted by a massive data breach that's resulted in people's driver's licenses ending up on the dark web.

Reportedly 153,000,000 licenses from both American and Canadian drivers are available on the online service, as well as at least 579,000 medical cards.

The news was first reported by KrebsOnSecurity, who received an alert from a source on August 31.

"On Monday, Aug. 31, a source alerted KrebsOnSecurity to a service advertised by a new user on the Russian cybercrime forum Exploit, offering access to digital scans of identity documents on more than 170 million people in North America," former Washington Post reporter Brian Krebs wrote.

"The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit."

Millions of people's driver's licenses are reportedly available to buy on the dark web (Getty Stock)

Krebs has shared a screenshot of his license that's available on the service. Somebody can unlock the details on it for a fee of $100.

Details include address, birthday, license expiration date and issue date, and Krebs' ID number.

Per Krebs' findings, the service, which is called Nexus, claims to have 153 million drivers licenses for people in the United States and Canada, more than 10 million identification cards, more than three million travel documents, and at least 579,000 medical cards.

Allegedly scammers got the the license images from an active breach at 'a major identity verification company' whose customers include multiple Fortune 500 companies.

"We have been continuously exfiltrating new data for over a year into our private database," the service says on Exploit. "Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available."

Hackers appear to be charging $100 to share people's details online (Getty Stock)

It has since been reported that the breach could be from a New Orleans-based identity-verification company whose technology is used by businesses to scan and authenticate government-issued IDs, says Yahoo! News. This has not been confirmed, however.

What has been confirmed is that the FBI is investigating the matter. The FBI’s New Orleans Field Office told NOLA.com that the bureau 'can confirm that it is looking into the incident'.

Speaking to the news outlet in an article published September 3, Zach Edwards, a staff threat researcher at the cybersecurity firm InfoBlox, expressed concerns about national security threats from the breach.

"There’s never been a breach of drivers license data at this scale, and the threat actors behind this seem to be both sophisticated and also financially motivated, which is a bad sign for any efforts to prevent the data from spreading further," he said.

Edwards' license is one of the millions on that appears to be for sale on the website.