There is a reason why every single state data breach notification law in the United States requires organizations to notify individuals in the event a driver’s license has been compromised. And I have two real life stories to show why it is so important to keep your driver’s license number safe and secure, just like your Social Security number.
Just a few days later, after I told someone about this surprising fact pattern, they told me that the same thing happened to them. In their situation, someone walked into a credit union in another state where they did not reside and had a fake driver’s license and their bank account number, and with those two items, was able to get a money order issued for $2,700 against their bank in another state. Again, a very surprising scenario.
On September 1, 2026, my colleague Brian Krebs of KrebsonSecurity, reported that the Russian cybercrime forum Exploit was offering access to identity documents of more than 170 million people in North America. According to Krebs, the service, also known as Nexus, was advertising the sale of and access to driver’s license scans and other forms of identification. They alleged that they had over 153 million driver’s licenses, over 10 million ID cards, and millions of other documents, (including the driver’s license for the assistant director of the FBI). The company that had been compromised, IDScan.net, located in New Orleans, publicly disclosed the incident on September 4, 2026. The incident is being investigated by the FBI.
On top of that, just a few days later, the Florida Department of Highway Safety confirmed that the credentials of a local police employee’s device had been compromised that allowed the ShinyHunters criminal gang access to driver’s license information, motor vehicle records, document images and other personal information of more than 200,000 Floridians.
These incidents make September one of the worst months ever for the compromise of individuals’ driver’s license information.
Getting back to the original story. Now that over 153 million driver’s licenses have been compromised, and that criminals appear to be able to use those driver’s licenses to withdraw funds from bank accounts and obtain money orders, how can one protect themselves?
It is nearly impossible to get a new driver’s license number. It is equivalent to a Social Security number. Here are some tips (also here) (though they don’t really address how a criminal can withdraw money out of an account with a fake driver’s license or obtain a money order—banks and credit unions should consider how to authenticate customers knowing that 153 million driver’s licenses have been compromised):
- Monitor your credit report and financial statements;
- Place a fraud alert on your credit or freeze your credit;
- Follow up if you see any anomalies on your credit report or obtain communications from financial institutions with which you don’t have a relationship;
- If you have been a victim, contact law enforcement and file a police report;
- Notify the Department of Motor Vehicles; and
- Enroll in a credit monitoring program.
If you receive a letter that your driver’s license has been compromised, you may wish to consider signing up for the services offered, and either way, follow the tips above to protect yourself from becoming a victim.