A new dark web service called Nexus launched this week on the Russian cybercrime forum Exploit, offering digital scans of more than 153 million driver’s licenses from people in the United States and Canada. The records include front-and-back scans captured under ordinary, infrared, and ultraviolet light — the same multi-spectrum imaging used by professional identity verification terminals. Based on reporting by journalist Brian Krebs, who found his own license in the service as a free sample, the images appear to be coming from an ongoing breach at idscan.net, a Louisiana-based identity verification company whose technology is installed at more than 20,000 locations worldwide. idscan.net says it processes over 21 million verifications monthly for clients that include Hertz, Target, FedEx, Motorola Solutions, Caesars Entertainment, and more than 1,000 marijuana dispensaries across 19 states. Each stolen record includes a timestamp; researchers who participated in Krebs’s investigation confirmed that the timestamps match dates when they handed over their licenses at a Hertz rental counter or at a dispensary — not at airport security checkpoints, which mostly use passports. The record count has been growing by roughly 400,000 entries every 24 hours, suggesting the attacker still has live access to the source system.
The New Orleans field office of the FBI opened an official investigation into the apparent breach on September 1, 2026. idscan.net told KrebsOnSecurity it is investigating but has not issued a public statement. Beyond the 153 million driver’s licenses, Nexus claims to hold more than 10 million identification cards, three million travel documents, and 579,000 medical cards — including records of a sitting U.S. cabinet secretary and the assistant director of the FBI. Security researcher Zach Edwards noted that the breach exposes a structural vulnerability in the growing push to require driver’s license scans for everything from car rentals to cannabis purchases to age-gated online services: every additional vendor that collects your ID becomes another attack surface. State-issued driver’s licenses are widely accepted as primary identity proof for opening lines of credit, making fraudulent account takeover the most immediate downstream risk for people whose records appear in Nexus.