60
60
60
60
FBI Probes Service Selling 153M+ Drivers Licenses
Dark web service Nexus sells scans of 153M+ US and Canadian drivers licenses, apparently siphoned from a breached identity verification company; FBI opened an inquiry.
A new dark web identity theft service called Nexus, advertised on the Exploit forum, offers scans of more than 153 million drivers licenses from the US and Canada, plus over 10 million ID cards and millions of travel and medical documents. The data appears to come from an ongoing breach at a major Louisiana-based identity verification company, with records growing by roughly 400,000 in 24 hours. Records include high-ranking US officials such as Defense Secretary Pete Hegseth, and timestamps suggest data was captured during car rentals and travel. The FBI's New Orleans field office has launched an official inquiry into the source of the images.
88
30
30
I rented a car, and within hours, my driver's license was for sale
Dark-web site Nexus is selling about 153 million driver's license scans, apparently harvested near real time from IDScan.net's service used by Hertz and others.
KrebsOnSecurity reported that the dark-web marketplace Nexus offered roughly 153 million driver's license scans for sale, including the author's license shortly after it was scanned at a car rental. New scans appeared within hours to a day of presentation, implying near real-time access to data flowing through IDScan.net's ID scanning service, which lists Hertz and 11 other companies as customers and captures infrared and ultraviolet spectra. License listings grew by about 400,000 over 24 hours, indicating the leak was ongoing. Nexus went dark hours after the report, and the FBI is investigating.
85
60
Dark Web Service Nexus Sells 153M+ Driver's Licenses
Dark web service Nexus offered 153M+ US and Canadian driver's license scans, traced to suspected IDScan.net breach; the FBI opened an investigation.
A dark web identity theft service called Nexus began offering searchable access to more than 153 million scanned US and Canadian driver's licenses, plus 10M+ ID cards, 3M+ travel documents, and 579,000+ medical cards. KrebsOnSecurity traced the records to New Orleans identity verification firm IDScan.net, whose clients include Hertz, Target, FedEx, Motorola Solutions, Caesars Entertainment, Jack Henry, and Planet13 dispensaries. The FBI's New Orleans field office opened a formal investigation, and Nexus went offline soon after the story broke. Operators claim exfiltration has been ongoing for over a year, with records growing by roughly 400,000 per day.
92
60
57
30
30
New CISO appointments 2026
Companies including Mistral AI, Trellix, Marriott, and ANZ appointed new CISOs in July-September 2026 amid high security-leadership turnover.
CSO Online's rolling column tracks senior security appointments, noting many companies are hiring a CSO/CISO for the first time. Notable moves include Thomas Coudray leaving Ledger to become Mistral AI's CISO, David Soto joining Trellix from Amazon, and Daniel Dubowski becoming Marriott International's SVP and CISO. Other appointments span ANZ, Gigamon, Axonius, Tricentis, Remitly, Allied Universal, and the State of California.
14
Multiple Class Action Lawsuits Filed Against IDScan
At least four class-action lawsuits filed against IDScan.net over an alleged breach exposing 153 million driver's licenses; FBI investigating.
At least four class-action lawsuits were filed in the US District Court for the Eastern District of Louisiana against IDScan.net following reports of a potential mega-breach of driver's license data. A Russian cybercrime forum service called Nexus claimed over 153 million driver's licenses, mainly American and Canadian, plus over 10 million ID cards, travel documents, and medical cards. The FBI is investigating the incident, which was first reported by journalist Brian Krebs, and IDScan.net says it is investigating. IDScan.net provides B2B ID verification services for clients including Hertz, FedEx, and hundreds of US cannabis dispensaries.
90
FBI investigates breach of 153 million driving license records at IDscan.net
Scans of 153 million driver's licenses, traced to IDscan.net and including Pete Hegseth and Brian Krebs, were offered for sale on the dark web.
Digital scans of 153 million driver's licenses appeared for sale by a user on the Russian cybercrime forum Exploit, alongside over 10 million ID cards, 3 million travel documents, and 579,000 medical cards sold through a site called Nexus. KrebsOnSecurity traced the leak to identity verification provider IDscan.net, whose customers include car rental company Hertz, and victims reportedly include US Defense Secretary Pete Hegseth. The FBI has opened an official inquiry into the source of the images, and IDscan.net has not issued an official statement.
88
AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks
Researchers found 120 corporate llms.txt files pointing to unregistered packages, demonstrating AI coding agents install and execute attacker-controlled code on Fortune 500 networks.
Researchers at an Israeli stealth startup scanned 6,214 live domains belonging to defense contractors, Fortune 500 and Big Tech companies, finding 120 llms.txt files that pointed to unregistered code packages or domain names. After registering a handful of the unclaimed names, they received a phone-home beacon within an hour from a Fortune 500 company and dozens more over time. Parent-process chains showed coding agents including Claude, OpenAI's Codex and Nous Research's Hermes executed the installed packages. The researchers warn agents treating vendor docs as ground truth creates a SolarWinds-style supply-chain surface as agent adoption spreads across SaaS, cloud and endpoints.
65
ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories
Microsoft warns of Teams IT-impersonation intrusions deploying Node.js implants; Spring Ring vishing hit 150+ employees across 10 companies; The Gentlemen ransomware claims 683 victims.
Microsoft warned of a human-operated campaign abusing Teams external collaboration to impersonate IT help desk staff, deploy malicious MSI packages staging Node.js runtimes and obfuscated JavaScript implants, then pivot to domain controllers over WinRM. Unit 42 documented the Spring Ring vishing operation targeting over 150 employees across at least 10 companies using 26 attacker identities, including an NTLM relay variant against domain controllers. Sophos reported The Gentlemen ransomware (Gold Sherwood) reached 683 total victims by end of July 2026, adding 169 in July, with a playbook using BYOVD-based EDR killers and backup tampering. Group-IB found the Outsider phishing-as-a-service platform created 700+ new phishing pages within a month despite law enforcement takedowns.
72
A battery storage cyberattack would look exactly like a badly tuned controller
Risk modeling suggests a few hundred compromised grid-scale batteries dispatched through cloud optimizers could trigger blackouts in Texas or Great Britain.
Centrii analysis estimates 1,500 compromised one-megawatt units (5.4% of ERCOT's ~28 GW fleet) or 400 units (about 29% of Great Britain's ~1,400-unit fleet) could destabilize the grids, with modeled damage of $12-65 billion in Texas and a national blackout costing £2-10 billion in Britain. The study puts the probability of a major attack affecting at least one million people by 2031 at 92.1%, dropping to 61.4% with IEC 62443 certification and quarterly drills, based on 10,000 Monte Carlo runs. Because hostile battery swings are phased like legitimate frequency response, control rooms would see nothing unusual; Centrii proposes hunting for a reverse-governor signature where inverter output feeds oscillations. Spain's April 2025 blackout took an expert panel until March 2026 to rule out cyberattack, partly because key plants had no recordings.
30
55
42
30
57
60
57
30
30
57
30
30
30
50
35
42
42
30
30
42
30