Dark web service sells 153 million driver's license scans

A dark web service calling itself Nexus is selling driver's license scans of more than 153 million people in the United States and Canada, and the images appear to have been siphoned from the systems of a widely used identity verification company based in Louisiana. The New Orleans field office of the Federal Bureau of Investigation (FBI) opened an official inquiry into the matter on Sept. 1, 2026, according to reporting by KrebsOnSecurity, which traced the records and identified the vendor at the center of the case as IDscan.net. The dark web is the part of the internet that can only be reached with special software and is not listed by ordinary search engines.

The story surfaced when a source alerted KrebsOnSecurity on Monday, Aug. 31 to a service advertised by a new user on Exploit, a Russian-language cybercrime forum. The advertisement offered access to digital scans of identity documents belonging to more than 170 million people in North America, and the seller included the reporter's own Virginia driver's license as a free sample in the opening sales thread.

Nexus claims to hold more than 153 million driver's licenses from the United States and Canada, along with more than 10 million identification cards, more than 3 million travel documents or international IDs, and at least 579,000 medical cards. A blank search on the service, with no search terms entered, returns roughly 11.5 million pages of results at about 15 results per page. Filtering for Canadian licenses alone returns approximately 1.1 million results, the largest single concentration being Ontario with 473,673 records.

The data set is not limited to driving documents. Records also include marijuana dispensary cards, and some entries carry a source label of "CDL", presumably short for commercial driver's license, a license that allows its holder to drive larger vehicles such as trucks and buses for work. Other records are labeled "CAC", which may refer to Common Access Cards, government-issued identity cards that grant physical access to government buildings and secure rooms. Among the records is the driver's license of U.S. Defense Secretary Pete Hegseth, one of several high-ranking government officials whose licenses can be found on the service.

The people behind Nexus claim the license images come from an active breach at "a major identity verification company" whose customers include multiple Fortune 500 companies, and they said the operation had been pulling new data into a private database for more than a year. The service said records can be previewed before purchase with sensitive details hidden, and that customer photos are shown when available. Over a single 24-hour period during the reporting, the count of driver's license records listed as available rose by nearly 400,000, which suggests freshly stolen license data is being harvested and uploaded on a semi-regular basis.

To work out where the images came from, KrebsOnSecurity examined the files themselves. The record containing the reporter's license held six images: three pairs of photographs of the front and back of the card, a basic image scan, plus infrared and ultraviolet versions of the same images, which are types of light beyond what the human eye can see and are used to check that an identity document is genuine. A date and timestamp, meaning a record of the exact day and time, was attached to each file, and the stamp on that license matched a date in June 2025 when the reporter flew to the midwest United States for a family funeral.

More than a dozen friends and family members were asked for permission to search for their licenses. Each of the nine whose documents were found confirmed they had traveled on or very close to the dates in the timestamps attached to their images. The timezone of the timestamps is unclear, but car rental records shared by several of the people who helped suggest the stamps are set to Greenwich Mean Time (GMT), the time standard used in Britain.

Airports were an early theory, but it fell apart because there are no passports in the data set, and only some of those who helped said they showed a driver's license at an airport on their travel date. One person whose license appeared had not flown recently at all, but had been renting a car from Hertz for several months around the date on their timestamp. Two of the helpers are federal employees who said they presented other government identification at airport security, yet both said they handed over their state-issued driver's licenses later that day when collecting rental vehicles at their destinations, both from Hertz.

The reporter's own case points the same way. A calendar note for the June 2025 flight reminded him to bring his passport, and he recalled that he never showed his driver's license at Reagan National Airport that day because he did not yet hold a Real ID, a security-enhanced driver's license that the Transportation Security Administration (TSA) now requires for all domestic travel; he showed his U.S. passport instead. His mother's license was also in the service, with timestamps only a few seconds apart from his, and the two of them had handed their licenses to the same Hertz rental representative at the same time. According to his mother, the rental counter was the only place she gave her license that day. KrebsOnSecurity sought comment from Hertz and said the story would be updated if the company replied.

Security and privacy researcher Zach Edwards, who recently launched a service called DecryptAds that helps people understand how online advertisers track them, also found his license for sale. He said the timestamp on his record matches the middle of a trip to Las Vegas last month for the annual DEFCON security conference. Edwards did not rent a car in Las Vegas, but he did hand over his license at the TSA checkpoint, at a marijuana dispensary and at his hotel, the Aria. Of those three, he said, the only place that definitely scanned his ID in a device was the dispensary, Planet13, a multi-state chain with stores in California, Florida, Illinois and Nevada. In 2022, IDscan.net published a press release announcing an exclusive identity verification agreement with Planet13's dispensaries nationally, and the company says it processes ID verification for more than 1,000 marijuana dispensaries in 19 U.S. states.

The "trust" page of idscan.net states that the company provides identity verification services for a list of big brands that includes Hertz, Target, FedEx, Motorola Solutions, the financial services giant Jack Henry and Caesars Entertainment. The company's own documentation says its technology scans IDs with both infrared and ultraviolet light, and that its systems perform more than 21 million verifications a month at more than 20,000 locations around the world. Contacted by KrebsOnSecurity, IDscan.net said it was investigating but had not yet issued an official statement or given a substantive reply to specific questions. Jil