In September 2026, cybersecurity journalist Brian Krebs found his own driver's license being offered as a free sample on a dark web marketplace called Nexus. The marketplace claimed to hold more than 153 million U.S. and Canadian licenses, along with other identity documents.
The FBI opened an investigation. IDScan.net, an identity-verification company linked to the records, later acknowledged that an unauthorized third party may have accessed or copied customer information from its cloud environment.
But the bigger question is not how the breach happened.
It is what someone can actually do with your license once they have it, and what you can realistically do about it.
The honest answer is less dramatic than the headlines and more persistent than most people expect. Knowing what to do next matters far more than knowing exactly how the data escaped.
Your Novelty ID, Ready to Ship When You Are
A Stolen License Is Not a Stolen Credit Card
A credit card number is replaceable. Your identity is not.
If someone gets your card number, the bank freezes it and issues another one within days. A driver's license is tied to information that does not change nearly as easily: your name, date of birth, address, photograph, and a government-issued identification number.
That makes a stolen license useful long after the physical card itself has been replaced.
The Federal Trade Commission specifically advises people whose license information has been exposed to contact their state motor vehicle agency, which may be able to flag the number or recommend a replacement.
And replacing the card is not the end of it, because the copy may already be somewhere else entirely.
What Can Someone Actually Do With It?
A stolen license does not automatically give someone access to your bank account or let them walk into a lender and collect a loan. Identity theft is rarely that simple.
The license becomes valuable because it gives a criminal a real piece of your identity to combine with other information.
They may try to open accounts in your name. A license is commonly used as part of identity verification, so a clear image of yours can be paired with other stolen or fabricated details when applying for credit, financial services, or phone accounts. Whether that works depends on the company's verification process. A license alone is not a universal key, but it makes an impersonation attempt more convincing.
They may build a synthetic identity. Synthetic identity fraud combines genuine information belonging to real people with fabricated information, so a criminal might use a real license number paired with a different address and invented details. The result is not a copy of you. It is a new identity assembled from pieces of real ones, which makes it considerably harder to trace.
They may simply use it to make scams more convincing. A license gives a scammer context that a random email address does not. Instead of "Dear customer, your account has a problem," a message can become "We need to verify the driver's license information you submitted." That does not make the message legitimate. It makes it harder to dismiss.
What the Nexus Incident Actually Showed
The most important part of the story is not that criminals want driver's licenses. They always have.
The bigger issue is how many copies of those licenses accumulate inside companies that verify identities on behalf of other businesses.
When you rent a car, check into a hotel, verify your age, or use any service requiring an ID scan, you may not be handing that document to the company you think you are dealing with. A third-party identity-verification provider often processes it instead.
Krebs found his own license and his mother's license in the marketplace, and by comparing those records against previous transactions he traced the documents back to businesses using a particular verification technology. His reporting also found evidence that new records were being added over time, suggesting ongoing collection rather than a single old database dump.
The 153 million figure deserves caution, though. It is a marketplace claim, not a confirmed count of unique people. There could be duplicate records, multiple scans of the same document, outdated documents, or data pulled from more than one source. There is still no public, authoritative list of everyone affected.
What to Do If Your Information Was Exposed
Do not panic, and do not ignore it either. The useful response is fairly short.
Contact your DMV. Tell the agency that issued your license that the information may have been exposed and ask what options exist. Depending on the state that may include flagging the number, replacing the card, issuing a different number, adding an identity-theft notation, or reviewing your driving record for activity you do not recognize. Do not assume every state handles this the same way.
Freeze your credit. A freeze prevents potential creditors from accessing your credit report, which makes opening a new account in your name considerably harder. It is free, it does not affect your credit score, and you do not have to wait until someone actually commits fraud. You will need to contact Equifax, Experian, and TransUnion, and the freeze stays in place until you lift it.
Consider a fraud alert. This works differently. It tells businesses to take additional steps to verify your identity before opening new credit. An initial alert lasts one year and is free, and you only need to contact one bureau because that bureau must notify the other two. You can have both a freeze and an alert.
Check your credit reports. Look for new accounts, unfamiliar inquiries, collection accounts, addresses you do not recognize, and loans you never applied for. Free reports are available through AnnualCreditReport.com. Do not check once and forget about it, because identity theft does not always surface immediately.
Check your driving record. This step is easy to overlook. A stolen license is not useful only for financial fraud, and if someone has attempted to use your identity during a traffic stop you want to know. Ask your state agency what records you can review and how to report anything that is not yours.
Report actual identity theft. If you discover your information has genuinely been used, report it through IdentityTheft.gov. The FTC can generate an Identity Theft Report and a recovery plan, which helps when disputing fraudulent accounts with businesses. A police report can be useful documentation too.
Keep the distinction clear. A data exposure means your information may be available to criminals. Identity theft means somebody actually used it. Those are not the same thing.
Can You Check Whether You Were Included?
Not reliably. There is currently no confirmed public lookup tool where you enter a license number and get a definitive answer.
That matters, because plenty of people will encounter websites or messages claiming they can check the dark web on your behalf.
Be careful with those. If an unexpected email or text says your license was found in a breach, do not click the link just because the message contains details about you. The FTC has warned about phishing messages that claim personal information is being sold or exposed, and its advice is to avoid the contact information in a suspicious message and instead reach the company through a number or website you already know is legitimate.
If you received an official breach notification, use the contact details in that notice. If you believe a particular business scanned your license, you can ask which verification provider it used and whether your information may have been involved. Do not expect a definitive answer yet.
Does Freezing Your Credit Solve It?
No, and this is one of the most important distinctions to understand.
A credit freeze is designed to make opening new credit accounts in your name harder. It does not erase a stolen license image, prevent someone attempting to impersonate you, stop phishing attacks, protect every existing account, or prevent every type of identity fraud.
Think of it as closing one major door in a building with several. You still need to watch what happens at the others, which is why monitoring your reports and accounts matters even with a freeze in place.
The Bigger Problem Is Not the Dark Web
The uncomfortable part of this story happened long before any licenses appeared on a marketplace.
People increasingly have to show identification to prove who they are. Businesses increasingly use third-party systems to scan and verify those documents. And once a license has been scanned, there is a question almost nobody gets to ask: how long does that copy stay there?
A license shown once for verification can become a digital record stored somewhere long after the original transaction finished. Security professionals raised exactly this concern in response to the incident, arguing that identity-verification companies effectively become large repositories of government-issued documents.
You cannot control how a business stores your ID after you hand it over. You can ask questions. Who is actually processing this document? How long is it retained? Is it stored by you or by a third party? Is there an alternative verification method that does not require keeping a full image?
Those questions will not undo a breach. They may reduce how many copies of your identity exist in the first place.
Ready to Order Your Fake ID?
Frequently Asked Questions
Is a stolen driver's license worse than a stolen credit card?
In some ways, yes. A card can be canceled and replaced quickly. A license carries identity information that is far harder to change, including your name, date of birth, photograph, and government-issued number.
What can someone do with a stolen driver's license?
They may attempt to open accounts, build a synthetic identity, impersonate you, or make phishing attempts more convincing. It does not hand anyone your finances directly, but it is a valuable piece of a larger attempt.
Were 153 million people actually affected by the Nexus marketplace?
That has not been established. The figure was the number of records the marketplace claimed to hold, not a confirmed count of unique individuals, and no public list of affected people exists.
What should I do first if my license data was exposed?
Contact your state motor vehicle agency, ask whether the number can be flagged or replaced, freeze your credit with all three bureaus, and review your credit reports for activity you do not recognize.
Does a credit freeze protect me from license fraud?
Not completely. A freeze primarily blocks new credit accounts. It does nothing about someone possessing or attempting to use a stolen license image, which is why agency action and ongoing monitoring still matter.
If the marketplace disappears, does the danger go away?
No. Removing a site does not guarantee previously copied data was deleted, and other copies may exist, so monitoring remains worthwhile regardless of whether the original marketplace is still online.
Final Thoughts
A driver's license appearing on the dark web does not mean someone has already stolen your identity. It does mean a piece of your identity is now in the hands of people you never gave it to.
That is why the response should be practical rather than panicked. Contact your DMV. Freeze your credit. Check your reports. Review your driving record. Watch for suspicious messages. Report actual theft when you find it.
And do not assume that taking down a marketplace solves the problem. A website can disappear in a day. A copy of your license stays useful far longer. That is what makes document breaches different from the password leaks people have grown used to. You can change a password. You can replace a credit card. You cannot replace your identity.