# Half of America Is In the Database: The FBI Is Probing Who Built It
The operation had a storefront, a price list, and reportedly a customer base willing to pay for instant access to driver's license records on virtually any American adult they wanted to look up. When federal investigators started pulling the thread, what they found was a database containing more than 153 million driver's license records — and a service built around selling queries into it.
The FBI's investigation into this lookup service, first reported by Krebs on Security, is still developing. But the scale alone demands attention: 153 million is not a breach number. It is a population number.
## This Is Not a Data Breach. It's a Business.
The framing matters. Most people hear "data breach" and picture a one-time event — a company gets hacked, records leak, the company patches its systems and sends apology emails. What federal investigators appear to be looking at is something different: a persistent criminal service that monetized a massive trove of personally identifiable information by selling access to it on demand.
That distinction changes everything about the threat model.
A bulk data dump is bought once and ages — addresses change, people move, records go stale. A lookup service built on live or recently-acquired data is something you query for a specific target, on demand, when you need it. That's a fundamentally more dangerous capability, and it's exactly the kind of tool threat actors use for:
Driver's license records are particularly potent for all of these. A standard DL contains your legal name, date of birth, current address, physical description, and a state-issued document number. That's five or six identity-confirming data points in a single record.
## 153 Million: Where Does That Number Even Come From?
The US has roughly 233 million licensed drivers. A database of 153 million records represents about two-thirds of them. That kind of scale doesn't come from hacking one company. It comes from aggregating many sources over time.
The likely contributors to a database this size include state DMV records — several states have been breached or had data exposed through vendor compromises in recent years — as well as data brokers, insurance telematics programs, and commercial data aggregators that lawfully compile driver records and sell them to insurers, employers, and background check services. The line between "commercial data broker" and "criminal data service" is sometimes thinner than regulators would like to admit.
Louisiana's DMV vendor MOVEit breach in 2023 alone exposed six million driver's license records in a single incident. Oregon hit another six million through the same vulnerability. Multiply similar incidents across states over the past decade and 153 million stops looking like an impossible number.
## What the FBI Investigation Signals
Federal law enforcement doesn't open a probe into a data lookup service just because it's large. The investigation suggests investigators believe they have enough to pursue criminal charges — likely under the Computer Fraud and Abuse Act, identity theft statutes, or wire fraud — and that the operation is ongoing and generating revenue.
The timing also matters. This investigation follows years of growing federal attention to the data broker ecosystem. The FTC has pursued enforcement actions against companies it argues have improperly sold sensitive consumer data. CFPB rulemaking has targeted certain data broker practices. Congress has debated — without passing — a federal data privacy law for the better part of a decade. Meanwhile, criminal entrepreneurs built the infrastructure everyone was arguing about regulating.
---
## HackWire Analysis
The 153-million-record driver's license service fits a pattern that's been accelerating since roughly 2020: the professionalization of PII markets. These aren't teenagers selling account credentials on paste sites. They're structured criminal services with customer acquisition, pricing tiers, and query interfaces that look more like SaaS products than black markets.
Compare this to the National Public Data breach of 2024, which exposed an estimated 2.9 billion records including Social Security numbers. That was a catastrophic bulk exposure. The service the FBI is now investigating is arguably more operationally dangerous at the individual level — it's targeted, queryable, and designed for use against specific people.
What this story is mostly missing in early coverage is the aggregation liability question. Some of the records in a database like this almost certainly passed through companies operating entirely within the law at some point — licensed data brokers, insurance carriers, state agencies with public records requests. The criminal element is in how the data was reassembled and monetized, not necessarily in how every individual record was originally acquired. That creates a genuinely hard regulatory problem: making it illegal to compile a database of lawfully public or commercially available information is constitutionally fraught. Prosecutors will likely argue the theft and unauthorized resale, not the compilation itself.
For defenders: if your organization uses knowledge-based authentication — "what was your last address," "what's the make of your car," "what state issued your driver's license" — you should treat it as compromised at this scale. These questions rely on the assumption that answers are private. They are not. Migrate to phishing-resistant MFA, and audit your KBA-dependent account recovery flows now.
Financial institutions, telecommunications carriers, and any business with high-value account recovery flows are the immediate target audience for whoever was buying queries into this service. The FBI probe may produce arrests. It will not delete the data.
— HackWire Editorial
---
## Related Coverage