FBI investigating dark-web service claiming 153M license records, raising CDL security concerns

The FBI is examining a dark-web service that claimed access to 153 million driver’s license records. The Nexus collection covered people across the United States and Canada. Some entries carried labels reading “CDL” or “ECDL.” Researchers warn that stolen credentials could complicate driver verification throughout the supply chain.

“The FBI can confirm that it is looking into the incident,” FBI New Orleans told FreightWaves. “Due to the ongoing nature of the investigation, we decline to comment further.” Authorities have not identified an affected transportation business or commercial driver. No evidence currently connects these records with cargo theft.

KrebsOnSecurity first reported the apparent connection involving Louisiana identity provider IDScan. net. The company has not confirmed unauthorized access involving its systems. Reuters also could not independently establish where the collection originated. Federal investigators have released no further details. IDScan.

net markets CDL authentication to transportation businesses. Its logistics page displays FedEx and Tractor Supply Co. , without explaining their current platform use. An IDScan case study describes an unnamed Northeast produce distributor using the company’s VeriScan identity-verification platform at a warehouse.

The company targets distribution centers, ports, freight brokers, 3PLs and motor carriers. FreightWaves previously examined IDScan’s warnings about fake CDLs and fictitious pickups. Chief Operating Officer Jillian Kossman described criminals using false credentials to impersonate legitimate drivers.

She explained that many fraudulent licenses appear convincing during visual inspection. That earlier discussion established IDScan’s role within pickup security. Nexus claimed continuous access Nexus appeared August 31 through an advertisement on the Russian cybercrime forum Exploit.

The operator promoted more than 160 million North American license and identification-card records. Another 10 million documents included travel credentials, residency cards and medical files. The advertisement claimed approximately 500,000 fresh additions arrived daily.

The threat actor also claimed persistent access to a major identity-verification company and its customers. According to the advertisement, the operation had continuously collected material for over one year. Those statements remain claims from the seller rather than confirmed investigative findings. IDScan.

net has not identified any compromised customer or platform. Zach Edwards, staff threat researcher at Infoblox, examined Nexus before the service disappeared. He found his own license from a recent cybersecurity conference trip in Las Vegas. Other entries contained submission dates across multiple days.

Those timestamps indicated that the collection included recently obtained documents. Brian Krebs separately watched the displayed license count increase by nearly 400,000 during one day. He found CDL and ECDL labels while searching unrelated names. “There were quite a few in results when searching for random things,” Krebs told FreightWaves.

Those files showed no differences from other license entries. Some states use ECDL for an enhanced commercial driver’s license. However, nobody has confirmed what either designation meant inside Nexus. Krebs found no scans tied directly to freight facilities or commercial pickups.

The database contained no warehouse names, shipment histories or transaction details. Nexus went offline shortly after Krebs published his findings. Its login page displayed a message announcing that the service was no longer available. No public evidence shows law enforcement caused that disappearance.

Investigators have not confirmed whether copies remain elsewhere. Stolen IDs could weaken pickup checks “The fact that this threat actor has potentially acquired commercial drivers licenses raises the stakes for freight companies,” Edwards wrote. Criminal groups already invest significant effort into appearing legitimate during cargo hijacking schemes.

Authentic identity documents could make those impersonation attempts harder to detect. Investigators have not connected any Nexus record with such activity. Many available files reportedly included photographs showing both sides of each card. Some entries also contained barcode data, ultraviolet images and infrared captures.

Criminals could use complete documents to impersonate victims during identity checks. Edwards warned that someone could print fraudulent licenses using genuine information. “Stolen documents can absolutely defeat KYC systems,” Edwards wrote. Digital scans alone may no longer provide enough certainty during hiring or pickup verification.

He recommended confirming that each person matches the presented identity. Freight facilities may also require physical credentials before releasing cargo. Merul Dhiman develops identity-verification technology for FreightCheck, which serves transportation companies. He identif