Glonce

FBI investigates Nexus, dark web seller of 153 million+ driver's licenses

securityThe Glonce editorsHacker News🔥74Glonce rating74Impact80Novelty60Relevance70Surprise65Players75Credibility85

A new identity theft service on the dark web, called Nexus, launched this week selling digital scans of more than 153 million driver's licenses belonging to people in the United States and Canada, according to security journalist Brian Krebs of KrebsOnSecurity. The service first advertised access to more than 170 million people's identity documents on the Russian cybercrime forum Exploit. Beyond driver's licenses, Nexus claims to hold more than 10 million identification cards, more than three million travel documents or international IDs, and at least 579,000 medical cards, including marijuana dispensary cards and documents marked "CDL" (commercial driver's license) or "CAC" (Common Access Card, used for US government facility access). A blank search with no parameters returned about 11.5 million pages of results at roughly 15 results per page, a rough check consistent with the 153 million figure. A search limited to Canadian licenses returned about 1.1 million results, the largest share (473,673) from Ontario. In the 24 hours before the story ran, the number of listed driver's license records grew by nearly 400,000.

Krebs learned of Nexus after its operator posted his own Virginia driver's license as a free sample in the forum sales post. He and about a dozen volunteers, including family members, then searched for their own licenses; nine were found, and each had traveled on or near the timestamped date. The record for Krebs's own license held six image files, front and back pairs in ordinary, infrared and ultraviolet light, timestamped to a June 2025 flight for which he used his passport at airport security but showed his driver's license when renting a car from Hertz. His mother's license appeared in the same search, timestamped seconds apart from his own, matching the moment they both handed their licenses to the same Hertz counter employee. Security researcher Zach Edwards found his own license timestamped to a DEFCON trip to Las Vegas and traced the likely source to a Planet13 marijuana dispensary that scanned his ID; Planet13 has held an exclusive identity verification agreement since 2022 with idscan.net, a Louisiana based identity verification company. idscan.net says it verifies IDs for clients including Hertz, Target, FedEx, Motorola Solutions, Jack Henry and Caesars Entertainment, performing more than 21 million verifications a month across more than 20,000 locations, including for more than 1,000 marijuana dispensaries in 19 states. Nexus's operators claim the data comes from an active breach at an unnamed "major identity verification company" whose customers include multiple Fortune 500 firms, and say they have been exfiltrating new data into the database for over a year.

Contacted by KrebsOnSecurity, idscan.net said only that it was investigating the matter and gave no official statement or answer to specific questions. The FBI's New Orleans field office told Krebs on a conference call that it had opened an official investigation into a suspected breach involving idscan.net; the bureau's attention reportedly followed after Krebs told a source that Nexus was also selling the license of an FBI assistant director, though not, he noted, of FBI Director Kash Patel. Shortly after the story published, the Nexus site vanished from the dark web, its login page replaced by a message reading: "This service is no longer available."

Key facts

  • Nexus, a new dark web identity theft service, is selling scans of more than 153 million US and Canadian driver's licenses, plus over 10 million ID cards, three million-plus travel documents and at least 579,000 medical cards.
  • Journalist Brian Krebs traced the likely source to idscan.net, a Louisiana identity verification company used by Hertz, Target, FedEx and Planet13 dispensaries, by matching image timestamps on his own and his mother's licenses to a Hertz rental, and on researcher Zach Edwards's license to a Planet13 dispensary visit.
  • The FBI's New Orleans field office opened an official investigation into a suspected idscan.net breach, reportedly after Krebs mentioned Nexus was also selling an FBI assistant director's license.
  • idscan.net says it is investigating but has given no official statement or confirmation of a breach; the number of driver's license records listed in Nexus grew by nearly 400,000 in the 24 hours before the story ran.
  • Nexus's dark web site went offline shortly after the story published, its login page replaced with a message saying the service was no longer available.

Why it matters

This is not a leak of passwords or account numbers but of the physical documents institutions rely on to prove who someone is, including infrared and ultraviolet scans meant to make forgery harder. A service selling those scans at this scale, more than 153 million driver's licenses by Nexus's own count, undermines the verification systems themselves rather than any single account. The case also surfaces a category of exposure most people never think about: the ID scan handed to a rental car counter or a dispensary can end up copied into a private company's database indefinitely, with no way for the person who showed it to know that happened.

Who it affects

Anyone in the US or Canada who has shown a driver's license to a business using idscan.net's verification systems, which the company says process more than 21 million checks a month across more than 20,000 locations, including car rental counters (Hertz is named), retail and shipping chains (Target, FedEx), and more than 1,000 marijuana dispensaries in 19 states. The article does not establish that every idscan.net customer's records are in Nexus, only that the researchers who checked found their own scans there. None of the dozen or so friends and family Krebs asked to search found a passport among their own results, one reason he ruled out airports as the collection point; Nexus separately claims to hold more than three million travel documents or international IDs, so the article does not establish that passports are absent from the service overall.

How to use it

There is no self-service way to check whether a specific license is in Nexus, since the article does not describe the service as offering public lookups; the confirmations described came from researchers with direct access searching for names they already knew. The practical takeaway is caution going forward: anyone who has handed a license to a rental counter, retail chain or dispensary in the categories above should treat that document as potentially exposed, watch for new accounts or credit lines opened in their name, and consider that a physical ID scan, unlike a password, cannot simply be changed after exposure.

How solid is it

The reporting rests on Krebs's own investigation plus corroboration from named, on-the-record sources, Zach Edwards and Larry Baldwin, who each found their own licenses in Nexus and matched the embedded timestamps to specific trips and transactions. The link to idscan.net specifically is Krebs's own inference, built from Edwards's dispensary visit and idscan.net's public 2022 agreement with that dispensary chain; idscan.net itself has not confirmed a breach, and the FBI's statement confirms only that an investigation into idscan.net was opened, not that a breach at idscan.net was verified. The 153 million figure is a claim by Nexus's operators, which Krebs sanity checked against the service's own search result counts rather than an independent audit.

Risks and caveats

idscan.net has not confirmed a breach occurred; it has said only that it is investigating and has not answered specific questions. The article does not identify who operates Nexus or where they are based, nor give a timeline or scope for the FBI's investigation beyond idscan.net. It also does not establish which specific handoff, TSA, rental counter, dispensary or hotel, leaked any individual's license; for Edwards, only the dispensary is confirmed to have scanned his ID into a device, not confirmed as the leak point. As Larry Baldwin noted, the exposure is especially dangerous for people who cannot easily change their appearance, including those fleeing domestic violence or living under a new identity through the federal witness protection program.

“This category of people includes those fleeing domestic violence, and even people who have been assigned a whole new life and identity as part of the federal government's witness protection program.”

— Larry Baldwin, principal intelligence researcher at Cybera