FBI investigating dark-web service claiming 153M license records, raising CDL security concerns

FreightWaves previously examined IDScan’s warnings about fake CDLs and fictitious pickups. Chief Operating Officer Jillian Kossman described criminals using false credentials to impersonate legitimate drivers. She explained that many fraudulent licenses appear convincing during visual inspection. That earlier discussion established IDScan’s role within pickup security.

Nexus claimed continuous access

Nexus appeared August 31 through an advertisement on the Russian cybercrime forum Exploit. The operator promoted more than 160 million North American license and identification-card records. Another 10 million documents included travel credentials, residency cards and medical files. The advertisement claimed approximately 500,000 fresh additions arrived daily.

The threat actor also claimed persistent access to a major identity-verification company and its customers. According to the advertisement, the operation had continuously collected material for over one year. Those statements remain claims from the seller rather than confirmed investigative findings. IDScan.net has not identified any compromised customer or platform.

Zach Edwards, staff threat researcher at Infoblox, examined Nexus before the service disappeared. He found his own license from a recent cybersecurity conference trip in Las Vegas. Other entries contained submission dates across multiple days. Those timestamps indicated that the collection included recently obtained documents.

Brian Krebs separately watched the displayed license count increase by nearly 400,000 during one day. He found CDL and ECDL labels while searching unrelated names. “There were quite a few in results when searching for random things,” Krebs told FreightWaves. Those files showed no differences from other license entries.

Some states use ECDL for an enhanced commercial driver’s license. However, nobody has confirmed what either designation meant inside Nexus. Krebs found no scans tied directly to freight facilities or commercial pickups. The database contained no warehouse names, shipment histories or transaction details.

Nexus went offline shortly after Krebs published his findings. Its login page displayed a message announcing that the service was no longer available. No public evidence shows law enforcement caused that disappearance. Investigators have not confirmed whether copies remain elsewhere.

Stolen IDs could weaken pickup checks

“The fact that this threat actor has potentially acquired commercial drivers licenses raises the stakes for freight companies,” Edwards wrote. Criminal groups already invest significant effort into appearing legitimate during cargo hijacking schemes. Authentic identity documents could make those impersonation attempts harder to detect. Investigators have not connected any Nexus record with such activity.

Many available files reportedly included photographs showing both sides of each card. Some entries also contained barcode data, ultraviolet images and infrared captures. Criminals could use complete documents to impersonate victims during identity checks. Edwards warned that someone could print fraudulent licenses using genuine information.

“Stolen documents can absolutely defeat KYC systems,” Edwards wrote. Digital scans alone may no longer provide enough certainty during hiring or pickup verification. He recommended confirming that each person matches the presented identity. Freight facilities may also require physical credentials before releasing cargo.

Merul Dhiman develops identity-verification technology for FreightCheck, which serves transportation companies. He identified a greater concern for freight operations. “A CDL is an authorization token, not just an ID,” Dhiman wrote. A genuine credential can pass validation without confirming that the person belongs with the shipment.

“The system confirmed the document,” Dhiman wrote. “It never confirmed who was holding it.” He recommended matching a live person with the approved identity at pickup. That step connects the credential, driver and assigned load before release.

IDScan.net’s public relations firm acknowledged the FreightWaves inquiry and forwarded questions to company representatives. No substantive response arrived before publication. Reuters also could not independently establish the reported source. The FBI investigation remains ongoing.

Important questions still surround the incident. Investigators have not verified the advertised totals or identified a compromised system. Nobody has confirmed how many commercial licenses appeared within Nexus. Authorities also have not found any resulting freight fraud.

Why It Matters

Freight operations often treat a valid CDL as both identification and authorization to release valuable cargo. If criminals obtain genuine license files, one successful scan could release that shipment to an impostor.

CFCO

In my opinion, CFCO training reinforces why human-level verification must happen before freight leaves. An authentic CDL only validates the document, not the person standing at the dock. Teams must connect that individual with the approved carrier and assigned shipment before release.

Click here for more articles on cargo theft and freight fraud by Phil Brink.

Port inspection leads to $10M counterfeit Nike, Adidas seizure in California – FreightWaves

One complaint exposed $800K Texas grain theft spanning 176 loads – FreightWaves

Florida AG calls semi-truck a ‘rolling dungeon’ after 4 children confined for 6 years – FreightWaves