153 Million Driver's License Scans Leaked on Dark Web: Inside the Nexus/IDScan.net Breach Investigation
Quick Answer: A dark web service called Nexus advertised 153+ million U.S. and Canadian driver's license scans, reportedly sourced from ID-verification vendor IDScan.net. The FBI has opened an investigation — if you've scanned an ID at a rental counter, dispensary, or hotel recently, treat your identity documents as potentially exposed.
Last verified: September 6, 2026
Somewhere between a Hertz rental counter and a dispensary checkout in Las Vegas, a security researcher's driver's license ended up in a database he never agreed to be part of. Not a photocopy sitting in a filing cabinet — a timestamped, front-and-back, infrared-and-ultraviolet scan, searchable by anyone willing to pay a cybercriminal for access.
That's not a hypothetical. It's what investigative journalist Brian Krebs found this week when he stumbled onto a new dark web identity-theft service called Nexus. And the numbers behind it are staggering enough that even seasoned SOC analysts did a double take: over 153 million driver's licenses, tied to a single identity-verification vendor's alleged breach.
Table of Contents
- What Happened: The Nexus Marketplace
- The Scale of the Exposure
- How Krebs and Researchers Verified the Data
- The Suspected Source: IDScan.net
- Why Driver's License Scans Are More Dangerous Than Passwords
- How Investigators Verify Leaked Document Metadata
- Detection & Prevention: What SOC Teams and Individuals Should Do
- Expert Tips
- FAQ
- Conclusion
What Happened: The Nexus Marketplace
On August 31, 2026, a new identity-theft service surfaced on the Russian-language cybercrime forum Exploit. Calling itself Nexus, the operator claimed to hold identity documents belonging to more than 170 million people across North America — and, in the seller's own words, said the team had "been continuously exfiltrating new data for over a year" into a private database, according to Krebs's reporting.
Unlike a typical breach dump that gets posted once and goes stale, Nexus behaved like a live, growing dataset. Researchers tracking it reported the collection expanded by roughly 400,000 additional driver's license records in a single 24-hour window — evidence, per Krebs's analysis, that whatever pipeline was feeding it hadn't been shut off yet.
The Scale of the Exposure
According to reporting from KrebsOnSecurity, corroborated by SecurityWeek, CSO Online, and Infosecurity Magazine, Nexus advertised the following inventory:
- 153,347,439 U.S. and Canadian driver's licenses
- 10+ million other identification cards
- 3+ million travel documents and international IDs
- 579,000+ medical cards, including marijuana dispensary IDs
Most records were U.S.-based, but roughly 1.1 million Canadian driver's licenses were reportedly searchable, including 473,673 from Ontario alone. Each record allegedly included more than a single scan — front-and-back images captured in visible light, plus infrared and ultraviolet versions, the same formats identity-verification systems use to check for counterfeit security features.
How Krebs and Researchers Verified the Data
Claims of "millions of leaked records" are common in cybercrime forums and frequently exaggerated. What made this one different is that Krebs didn't just take the seller's word for it — he ran a blank search (no query terms at all) on Nexus and reportedly got back approximately 11.5 million pages of results at roughly 15 records per page, a figure that lines up with the claimed 153 million total.
He then went further, cross-referencing real people against real events. Researcher Zach Edwards found his own license in Nexus, tied to a timestamp that matched a visit to a Las Vegas cannabis dispensary — Planet13 — during DEF CON. Security consultant Larry Baldwin's exposed license lined up with a Hertz rental. Krebs's own license was reportedly offered as the platform's free sample listing. Even more notably, records tied to senior U.S. officials, including Defense Secretary Pete Hegseth, were reportedly found searchable in the database.
This kind of timestamp-to-real-world-event correlation is standard forensic practice for validating a breach claim — it's much harder to fake a dozen independently confirmed transaction matches than it is to fake a headline number.
The Suspected Source: IDScan.net
Multiple outlets, based on Krebs's investigation, point to IDScan.net, a Louisiana-based identity-verification provider, as the likely source. The company says it performs over 21 million ID verifications per month across more than 20,000 business locations, reportedly serving clients across car rental, retail, hospitality, cannabis, and age-verification sectors.
As of publication, IDScan.net has not confirmed a breach. The company has said only that it is investigating the claims and working to determine whether unauthorized access occurred and what data may be affected. That distinction matters: the 153 million figure currently comes from the criminals selling the data, not from an audited disclosure — a gap that may narrow or widen once IDScan.net or federal investigators release findings.
The FBI's New Orleans field office has confirmed it opened a formal investigation, according to Krebs's reporting, after being alerted that its own personnel's records were reportedly present in the leaked dataset.
Why Driver's License Scans Are More Dangerous Than Passwords
A leaked password can be rotated in seconds. A government-issued photo ID cannot. That asymmetry is exactly why security researchers are treating this incident as more severe than a typical credential-stuffing breach.
With a high-resolution front-and-back license scan, threat actors can potentially support:
- Synthetic identity fraud — blending real ID data with fabricated details to open new accounts
- Account takeover — using the ID image to pass "verify your identity" checks at banks or exchanges
- SIM-swapping — presenting a convincing scanned ID to a carrier store employee
- Loan and credit application fraud under the victim's name
- Social engineering and targeted phishing, using the real photo, address, and license number as pretext
There's also a quieter, non-financial risk. High-quality facial images paired with home addresses can create real safety exposure for people who specifically need to avoid being located — domestic violence survivors and individuals in witness-protection programs among them.
How Investigators Verify Leaked Document Metadata
Part of how researchers validated the Nexus timestamps was by examining embedded metadata in the image files themselves — a standard, purely defensive digital-forensics technique, not an offensive one. Security teams reviewing suspected leaked documents commonly use a metadata-inspection tool like exiftool to check for capture timestamps, device signatures, or GPS tags embedded in image files.
exiftool suspected_leaked_scan.jpgWhat it does: Reads embedded EXIF/metadata fields from an image file — creation date, modification date, and sometimes device or software information — without altering the file.
When to use it: During incident response or OSINT verification, when you need to confirm whether a leaked or suspicious image is authentic and roughly when it was captured, rather than take a claim at face value.
Expected output: A list of metadata fields (e.g., Create Date, Modify Date, Software) that can be cross-referenced against known events, such as a transaction receipt or travel record.
Note: Only run this against files you're authorized to inspect — never against a live breach site or third-party data you don't have permission to access.
Detection & Prevention: What SOC Teams and Individuals Should Do
For individuals
- If you've had your ID scanned at a rental car counter, dispensary, hotel, or age-verification kiosk in the past year, assume potential exposure and monitor accordingly
- Place a fraud alert or credit freeze with major credit bureaus (Equifax, Experian, TransUnion)
- Monitor for unexpected new account openings, loan inquiries, or SIM-swap attempts on your phone carrier account
- Consider requesting a new driver's license number from your state DMV if you have strong reason to believe your specific record was involved and your state supports reissuance for this reason
- Watch for phishing attempts referencing personal details that would only be known from a scanned ID (full legal name, license number, exact address)
For organizations that collect ID scans
- Minimize retention — delete scanned ID images immediately after verification completes; don't retain "just in case"
- Encrypt at rest and in transit, with keys managed separately from the storage environment
- Enforce least-privilege access to identity-verification databases, with logging on every query
- Monitor for exfiltration patterns — a service quietly siphoning data "for over a year" (as Nexus's operator claimed) is a detection failure as much as a prevention one
- Align retention and access controls with relevant frameworks — NIST 800-53 and, where health-adjacent data like medical/dispensary cards is involved, HIPAA-aligned safeguards — as general best practice rather than a compliance guarantee
Expert Tips
- Don't wait for an official breach notification before acting — by the time IDScan.net or any vendor confirms scope, the data has typically already changed hands multiple times on criminal marketplaces
- Nexus going offline is not resolution. As multiple outlets noted, the removal of one storefront doesn't mean the underlying data disappears — it's likely already been copied or resold
- If your organization uses third-party ID verification for age-gating or KYC, ask your vendor directly: how long do you retain scans, and can you prove deletion?
Related Cybersecurity Topics You Should Explore
- QR Code Phishing Just Hit Record Levels: What SOCs Must Know Now
- Microsoft Teams Won't Load? Inside the TM1466820 Windows Bug
- Why Ad Networks Get Your Blogger Blog Locked (Fix It Fast)
- The touch Command Trick Attackers Use to Fake File Timestamps
- WordPress Now Uses AI to Catch Security Flaws Before Hackers Do
- Mini Shai-Hulud Worm Hits npm Package With 150K Weekly Downloads
- more vs less Linux Commands: The SOC Analyst's Log Review Guide
- JFrog Artifactory Hacked: Attackers Are Minting Admin Tokens
- tail -f Explained: The Linux Command That Beats Your SIEM's Delay
- Brave Browser Now Hides Your Real Email From Every Website
- D-Link Router Flaw Lets Hackers Steal Your Wi-Fi Password
- 'This Blog Has Been Locked' — How to Backup Blogger the Right Way
- cPanel Zero-Day Lets Hackers Seize Root Control of Your Server
- TP-Link Kasa Vulnerability Lets Hackers Hijack Your Smart Home Devices
- CVE-2026-16444: The TeamViewer Bug That Turns File Transfer Into RCE
- Hackers Weaponize Fake Resumes to Hijack PCs Silently
FAQ
Q: Is it confirmed that IDScan.net was breached?
A: Not officially. IDScan.net has said it is investigating; the link comes from independent researcher analysis of timestamps and image formats, not a company disclosure.
Q: How do I know if my driver's license was part of this leak?
A: There's currently no official public lookup tool. If you've had your ID scanned commercially in North America in the past year or more, treat exposure as plausible and monitor your credit and accounts.
Q: Is Nexus still active?
A: The service reportedly went offline shortly after Krebs's report was published, replaced with a message stating it was no longer available. This does not mean the data itself is gone.
Q: Can I freeze my driver's license like I freeze my credit?
A: Not universally — this depends on your state DMV's policies. Some states allow flags or reissuance following identity theft; check with your local DMV directly.
Q: Why include infrared and ultraviolet scans in a data breach?
A: Identity-verification systems use these formats to detect counterfeit security features on physical IDs. Their presence in the leak suggests the source was a verification platform, not a simple photo upload service.
Q: What should businesses using ID verification services do right now?
A: Contact your vendor to confirm data retention practices, request an update on this incident specifically, and review your own internal access logs for anomalous activity involving stored ID data.
Conclusion
The Nexus/IDScan.net story is still unfolding — IDScan.net hasn't confirmed a breach, and the final scope may look different once the FBI's investigation and any official disclosure land. But the pattern here is a familiar one for anyone who's worked an incident: a marketplace claim, independent verification through real-world correlation, and a live investigation that started before the vendor even acknowledged a problem.
If there's one takeaway for security teams and everyday readers alike, it's this — physical identity documents can't be rotated like a password, which means the businesses collecting them carry a heavier responsibility than most realize. Minimize what you store, encrypt what you keep, and delete what you don't need.
Have you had an ID scanned recently at a rental counter, dispensary, or hotel? Share your thoughts in the comments, and subscribe for ongoing coverage as this investigation develops.
Analysis based on SOC monitoring and public threat intelligence review.