Breach Exposes 153 Million Driver Licenses on Dark Web

A dark web identity theft service named Nexus is offering more than 153 million driver license scans from people in the United States and Canada, and the FBI has opened an inquiry into the apparent source at a Louisiana-based identity verification provider called idscan.net. The service launched on August 31 on the Russian cybercrime forum Exploit, which is part of the dark web, a part of the internet not indexed by normal search engines and reachable only with special software. A source alerted KrebsOnSecurity after the service's operator posted the publication's Virginia driver's license as a free sample.

Nexus claims to hold 153 million driver licenses, more than 10 million identification cards, over three million travel documents or international IDs, and at least 579,000 medical cards. A blank search on the service returns roughly 11.5 million pages of results, with about 15 records per page. Most records are from the United States, but about 1.1 million are Canadian, with the largest concentration in Ontario at 473,673 records. The records also include marijuana dispensary cards, and some carry source notations such as 'CDL' (likely a commercial driver's license) and 'CAC' (possibly Common Access Cards used for physical access to government buildings). Nexus operators claim the data comes from an active breach at a major identity verification company whose customers include multiple Fortune 500 companies, and they say they have been continuously exfiltrating data, meaning copying it out without authorization, for over a year. The number of driver license records listed in Nexus increased by nearly 400,000 in 24 hours, indicating fresh data is still being harvested.

KrebsOnSecurity's own reporter discovered that their Virginia license record included six image files: front and back scans, a basic image, and infrared and ultraviolet versions, which are images taken under non-visible light to show security features like holograms and microprinting. The timestamp on the license scan corresponded to a June 2025 flight, but the reporter did not use the license at airport security because they showed a U.S. passport instead. The license was handed to a Hertz rental car representative at the same time as the reporter's mother, and the timestamps on their two records are only a few seconds apart. KrebsOnSecurity asked more than a dozen friends and family members for permission to search for their licenses in the service, and each of the nine people found confirmed they had traveled on or very close to the dates in their image timestamps. One person had not flown recently but had been renting a car from Hertz for several months around the timestamp date. The timestamps appear to be set to Greenwich Mean Time based on car rental records shared by several participants.

Security and privacy researcher Zach Edwards, who operates the DecryptAds service, found his license on Nexus with a timestamp matching the middle of a trip to Las Vegas for the DEFCON security conference. Edwards said he gave his license to a TSA checkpoint, a marijuana dispensary called Planet13, and his hotel, but the only place that definitely scanned the ID in a device was the dispensary. Planet13, a multi-state dispensary chain, has an exclusive identity verification agreement with idscan.net, a New Orleans-based provider that says it processes ID verification for more than 1,000 dispensaries in 19 U.S. states. The idscan.net trust page lists customers including Hertz, Target, FedEx, Motorola Solutions, Jack Henry, and Caesars Entertainment, and its documentation states its technology scans IDs with infrared and ultraviolet light. The company says it performs more than 21 million verifications monthly at over 20,000 locations worldwide.

When contacted by KrebsOnSecurity, idscan.net said it was investigating but did not provide a substantive reply. Jillian Kossman, a marketing and operations leader at idscan.net, wrote that the company could not share more information but welcomed the updates to help its team's investigation. The FBI's New Orleans field office opened an official investigation into an apparent breach involving idscan.net, and FBI agents from the cyber division held a conference call with KrebsOnSecurity. The reporter had learned that Nexus was also selling the driver's license information of an FBI assistant director, though the FBI Director's license was not found on the service.

Larry Baldwin, principal intelligence researcher at cybersecurity firm Cybera, found that a front and back scan of his driver's license on Nexus had timestamps matching a recent vacation car rental from Hertz. Baldwin said the service presents serious security and privacy threats because state-issued driver's licenses are commonly used as proof of identity when opening new lines of credit. He also noted that people who cannot meaningfully change their appearance, such as those fleeing domestic violence or individuals in the federal witness protection program, could be dangerously exposed by AI-based image matching tools. Baldwin said that just as authentication controls through driver's license verification systems were improving, this incident compromises the very thing those improvements depend on.

On September 8, idscan.net published a brief notice saying it had determined that an unauthorized third party may have accessed or copied certain customer information, including full names and driver's license or other government-issued identification numbers. The company said it was notifying affected individuals and offering credit protection services. Separately, a Caesars Entertainment spokesperson said Caesars has not been a client of idscan.net and has not used its VeriScan product since February 2025, did not authorize idscan.net to retain data from its accounts, and was told by idscan.net that the incident should have no impact on Caesars. Shortly after the story was published, the Nexus service website vanished from the dark web and replaced its login page with a message reading 'This service is no longer available.'

This incident is a reminder that any service that scans and stores driver's licenses becomes a high-value target. For website owners and businesses that use identity verification services, applying security-first principles to vendor relationships is critical, and AEU-I, AEU Group's security-first IT and consulting practice, works with organizations on security-first IT and infrastructure decisions.