The FBI said Wednesday it is investigating a dark web site that is reportedly selling more than 150 million U.S. and Canadian driver’s licenses, including the data of a senior FBI official.
A spokesperson for the agency confirmed the investigation in an emailed statement, saying the FBI is looking into the incident and declining to comment further due to the ongoing nature of the investigation. No timeline was provided.
Independent journalist Brian Krebs was the first to identify the criminal site, which had been advertised on a Russian cybercrime forum. What drew his attention was that his own Virginia driver’s license appeared as a free sample on the site. He published a report on Sept. 1 detailing that the site was offering digital scans of millions of licenses, and said nine people who confirmed their information had been compromised verified to him that the scans were authentic.
Among the licenses reportedly included in the breach is that of the FBI’s assistant director, a detail that underscores the scope of the breach and the exposure it creates even for senior federal law enforcement.
What a driver’s license data breach means
Driver’s license information is among the most sensitive categories of personal data because of how broadly it is used for identity verification. A typical credential includes full legal name, date of birth, residential address, physical description and a photograph. That combination creates a profile that can be used for identity theft, account takeover, document fraud and a range of other criminal purposes.
Digital scans, as opposed to extracted text data, add the dimension of physical document replication. A high-quality scan can be used to produce fraudulent documents that pass visual inspection, raising the stakes beyond what a typical breach involving personal information fields would create. The FBI is treating the matter as a serious federal investigation.
The inclusion of both U.S. and Canadian documents in a single data set suggests the breach either involved a vendor or service that processes them across both countries or that data from multiple sources was aggregated into a single marketplace.
The dark web marketplace context
Dark web marketplaces for stolen identity documents have operated for years and have become increasingly sophisticated. The advertising of high-profile victims’ data, such as a senior FBI official’s information or a journalist’s document, is a common tactic to establish credibility and draw buyers. Krebs’s identification of the site through his own data appearing as a sample reflects both the scale of the breach and the operational habits of criminal marketplaces.
The FBI confirmation does not indicate the scope of any law enforcement action or the identity of the operators behind the site. Dark web criminal marketplaces are frequently operated across international jurisdictions, which complicates enforcement.
What to do if your license may be affected
Anyone who suspects their information may have been compromised can place a fraud alert with the major credit bureaus, which makes it harder for someone to open new accounts using stolen identity information. Monitoring financial accounts and checking for unexpected applications for credit or government benefits is also recommended. Several states also offer identity protection services through their motor vehicle agencies.
