Cybersecurity Alert | 153M Driver’s Licenses Exposed- What to Do Now
On September 1, 2026, Krebs on Security reported that a service operating on the dark web began selling photographs of more than 153 million driver's licenses from the United States and Canada, along with roughly 10 million identification cards and 3 million passports and travel documents. The site has since been taken down and the FBI's New Orleans field office has opened an inquiry.
*Note: This does NOT mean your information or license was exposed in this breach. Rather, BlackCloak is alerting you to this report to keep you informed of best practices and any actions you can take if a personal exposure is confirmed, or as a precautionary measure for optimal security. BlackCloak will keep you updated if more information becomes available.
Why This Breach Is Different:
These Are Images, Not Records: Most breaches leak text like a name or a number. This one leaks the actual photograph of a license, which is what many services accept as proof of identity.
How it Happened: The exposure reportedly came from a routine transaction, not from anything an individual clicked or shared. Investigative reporting traced the images to an identity verification company whose scanning equipment is installed at more than 20,000 locations, including rental car counters, hotel front desks, dispensaries and TSA checkpoints.
What This Enables For Potential Misuse
A clear photo of a license removes the barrier that photo-ID checks are meant to enforce: opening financial accounts, porting a phone number, passing a “verify your identity” step, or defeating know-your-customer review at a crypto exchange. Combined with the brokered personal data already circulating, it materially raises one’s exposure to SIM swaps and identity fraud.
A Standing Rule Worth Adopting:
As a precaution, do not consider your license details as proof that a caller or email is genuine. If someone contacts you already holding that information, treat it as a reason for more scrutiny, not less, and confirm through a number or address you already have on file.
Proactive Steps to Take
Freeze Your Credit at All Three Bureaus: This is the single highest-value step and it is free. It blocks new-account fraud even when an attacker holds a perfect copy of your ID. Do the same for your spouse and for any adult children. Contact the Concierge Team if you’d like assistance with this process.
Add a Fraud Alert: Request a fraud alert alongside the freeze so any application attempt triggers additional verification.
Prevent SIM Swapping:: A license image is often enough to talk a carrier representative into a SIM transfer. Enable a SIM PIN and an account PIN with your carrier, and if it's offered, enable a number lock (such as offered through Verizon).
Treat ID-Verification Requests Skeptically: Do not photograph or upload your license in response to an inbound call, text or email, however official it looks.
Verify: If anyone contacts you quoting your license number or referencing a document you provided, end the conversation and call back on a number you already have on file.
Watch for Document-Based Fraud: Alert your bank and wealth manager that a copy of your ID may be circulating, and ask them to require a second factor beyond photo ID for account changes.
Confirm Your Information in the BlackCloak App: Confirm all your information (email accounts, addresses, SSNs etc.) is current in the BlackCloak mobile app to ensure the Platform is monitoring the most updated information.
If you would like help placing (or confirming) credit freezes, reviewing exposure across your household, or placing cellular carrier locks, contact the BlackCloak Concierge team at ask@blackcloak.io and we’re happy to walk through it with you.