Dark web service Nexus sells 153 million driver's licenses traced to IDScan.net

A dark web marketplace called Nexus was found selling digital scans of more than 153 million driver's licenses from US and Canadian residents, along with 10 million ID cards, 3 million travel documents, and 579,000 medical cards, according to investigative journalist Brian Krebs. The FBI's New Orleans field office has opened an inquiry into the apparent source of the leak.

The scale of this breach sets it apart from routine identity-theft incidents. Most leaked credential databases contain names, emails, and passwords — reusable but replaceable. Driver's license scans are different: they include physical biometric details, expiration dates, and government-issued document numbers that are far harder for victims to change, and the images themselves (front-and-back photos plus infrared and ultraviolet scans) can be used to forge convincing physical or digital copies.

Krebs traced the data to IDScan.net, a Louisiana-based identity verification company that says it processes more than 21 million ID checks per month for clients including Hertz, Target, FedEx, and Caesars Entertainment. Timestamp analysis on several victims' scans correlated with dates they had rented vehicles from Hertz, suggesting rental-car counters — not airports or dispensaries, despite IDScan.net's marijuana-dispensary-verification business — as a likely point of compromise. IDScan.net confirmed it is investigating.

The breach reaches into the highest levels of government: US Defense Secretary Pete Hegseth's driver's license was among the records listed for sale, alongside those of several other senior officials. Krebs reported that Nexus's operator offered his own Virginia license as a free sample when advertising the service — and that the database grew by roughly 400,000 new records within 24 hours of his initial report, indicating the pipeline into Nexus was still active as the story broke on September 1.

Nexus reportedly went offline shortly after Krebs' reporting drew public attention, but that does not undo the exposure — once physical ID scans are copied, they can be resold indefinitely on other platforms. For consumers, the incident is a reminder that scanning a driver's license at a rental counter or dispensary hands a third-party vendor a durable copy of the same document used to open bank accounts, pass age checks, and verify identity across dozens of services. For enterprises relying on identity-verification vendors, it raises the question of how long scanned ID images are retained after a transaction completes, and whether that retention period matches any real business need.