Incident Overview

A threat actor operating under the handle "SinCity" claims to be selling a dataset described as "53k USA Driver License" on the Exploit forum. The listing claims to contain approximately 53,000 front-side images or scans of U.S. driver licenses. No specific source organization or breach origin has been disclosed by the threat actor.

This marks the third time this particular threat actor has advertised U.S. driver license data for sale, with previous listings observed in October 2025 and December 2025. SinCity has an established pattern of selling identity documents and fraudulent materials, including prior listings for U.S. tax documents (1099 and W-2 forms). The actor is also known for selling unauthorized PrestaShop admin panel access and PHP shell access across multiple European countries including France, Spain, and Denmark.