FBI investigating dark-web service claiming 153M license records, raising CDL security concerns
FBI is investigating a dark-web service called Nexus claiming 153M stolen driver's license records, including CDL entries, potentially tied to identity-verification vendor IDScan.net used by logistics companies. No confirmed freight or commercial driver exposure yet, but the threat actor claimed persistent access to a major identity-verification platform for over a year.
This fits into the growing pattern of supply chain fraud and cargo theft targeting e-commerce logistics infrastructure — bad actors are systematically undermining driver verification systems that protect last-mile and fulfillment handoffs.
If IDScan.net is compromised, freight brokers and 3PLs using it for driver verification face elevated cargo theft risk via impersonation — fictitious pickups using stolen CDL credentials become much easier to execute. Sellers relying on carrier pickups at distribution centers should verify their LSPs are not using IDScan.net as their sole verification layer.
Operational Impact
This story may require teams to revisit workflows, monitoring, or platform assumptions.
Bottom Line
Stolen CDL records mean higher cargo theft risk for seller shipments at distribution centers.
Source Lens
Industry Context
Useful background context, but lower-priority than direct platform, community, or operator intelligence.
Impact Level
low
Stolen CDL records mean higher cargo theft risk for seller shipments at distribution centers.
Key Stat / Trigger
153 million driver's license records claimed stolen
Focus on the operational implication, not just the headline.
Full Coverage
The FBI is examining a dark-web service that claimed access to 153 million driver’s license records. The Nexus collection covered people across the United States and Canada. Some entries carried labels reading “CDL” or “ECDL.” Researchers warn that stolen credentials could complicate driver verification throughout the supply chain.
“The FBI can confirm that it is looking into the incident,” FBI New Orleans told FreightWaves. “Due to the ongoing nature of the investigation, we decline to comment further.” Authorities have not identified an affected transportation business or commercial driver. No evidence currently connects these records with cargo theft.
KrebsOnSecurity first reported the apparent connection involving Louisiana identity provider IDScan. net. The company has not confirmed unauthorized access involving its systems. Reuters also could not independently establish where the collection originated. Federal investigators have released no further details. IDScan.
net markets CDL authentication to transportation businesses. Its logistics page displays FedEx and Tractor Supply Co. , without explaining their current platform use. An IDScan case study describes an unnamed Northeast produce distributor using the company’s VeriScan identity-verification platform at a warehouse.
The company targets distribution centers, ports, freight brokers, 3PLs and motor carriers. window. googletag = window. googletag || {cmd: []}; googletag. cmd. push(function() {var gptSlot = googletag. defineSlot('/21776187881/FW-Responsive-Main_Content-Slot1', [[300, 100], [320, 50], [728, 90], [468, 60]], 'div-gpt-ad-1709668545404-0').
defineSizeMapping(gptSizeMaps. banner1). addService(googletag. pubads()); googletag. pubads(). enableSingleRequest(); googletag. pubads(). collapseEmptyDivs(); googletag. enableServices(); setInterval(function() {if (! document. hidden) {googletag. pubads(). refresh([gptSlot]); } }, 30000); }); googletag. cmd. push(function() {googletag.
display('div-gpt-ad-1709668545404-0'); }); FreightWaves previously examined IDScan’s warnings about fake CDLs and fictitious pickups. Chief Operating Officer Jillian Kossman described criminals using false credentials to impersonate legitimate drivers. She explained that many fraudulent licenses appear convincing during visual inspection.
That earlier discussion established IDScan’s role within pickup security. Nexus claimed continuous access Nexus appeared August 31 through an advertisement on the Russian cybercrime forum Exploit. The operator promoted more than 160 million North American license and identification-card records.
Another 10 million documents included travel credentials, residency cards and medical files. The advertisement claimed approximately 500,000 fresh additions arrived daily. The threat actor also claimed persistent access to a major identity-verification company and its customers.
According to the advertisement, the operation had continuously collected material for over one year. Those statements remain claims from the seller rather than confirmed investigative findings. IDScan. net has not identified any compromised customer or platform. Zach Edwards, staff threat researcher at Infoblox, examined Nexus before the service disappeared.
He found his own license from a recent cybersecurity conference trip in Las Vegas. Other entries contained submission dates across multiple days. Those timestamps indicated that the collection included recently obtained documents. Brian Krebs separately watched the displayed license count increase by nearly 400,000 during one day.
He found CDL and ECDL labels while searching unrelated names. “There were quite a few in results when searching for random things,” Krebs told FreightWaves. Those files showed no differences from other license entries. Some states use ECDL for an enhanced commercial driver’s license. However, nobody has confirmed what either designation meant inside Nexus.
Krebs found no scans tied directly to freight facilities or commercial pickups. The database contained no warehouse names, shipment histories or transaction details. Nexus went offline shortly after Krebs published his findings. Its login page displayed a message announcing that the service was no longer available.
No public evidence shows law enforcement caused that disappearance. Investigators have not confirmed whether copies remain elsewhere. window. googletag = window. googletag || {cmd: []}; googletag. cmd. push(function() {var gptSlot = googletag.
defineSlot('/21776187881/fw-responsive-main_content-slot3', [[728, 90], [468, 60], [320, 50], [300, 100]], 'div-gpt-ad-1665767553440-0'). defineSizeMapping(gptSizeMaps. banner1). addService(googletag. pubads()); googletag. pubads(). enableSingleRequest(); googletag. pubads(). collapseEmptyDivs(); googletag. enableServices(); setInterval(function() {if (!
document. hidden) {googletag. pubads(). refresh([gptSlot]); } }, 30000); }); googletag. cmd. push(function() {googletag. display('div-gpt-ad-1665767553440-0'); }); Stole
Audit your 3PL and freight broker contracts now — ask directly if they use IDScan.net or VeriScan for driver verification and what backup authentication exists if that system is compromised.
Within 30 days, add a secondary verification step for high-value shipment pickups (callback confirmation, sealed load protocols, or geo-verified driver check-in) independent of any single identity platform.
Original Source
This briefing is based on reporting from Freightwaves. Use the original post for full primary-source context.
Style
Audience