153 million-plus driver's license scans offered for sale on dark web; leak traced to IDScan.net as FBI probes and class actions mount

A dark-web sales operation called Nexus, run through the Exploit cybercrime forum, offered roughly 153 million US and Canadian driver's license scans for sale — apparently flowing near real time from identity-verification vendor IDScan.net, whose clients…

On 2026-09-02, KrebsOnSecurity reported that Nexus — a sales site/service operated via the Russian-language cybercrime forum Exploit, described in initial reporting as a dark-web marketplace — was offering roughly 153 million driver's license scans for sale, including the author's own license scanned at a car rental shortly before. The listing also included more than 10 million ID cards, about 3 million travel documents, and 579,000 medical cards. New scans appeared within hours to a day of presentation, and listings grew by about 400,000 over 24 hours, indicating the leak was ongoing and near real time. KrebsOnSecurity traced the trove to IDScan.net, a New Orleans-based identity-verification provider whose scanning service captures infrared and ultraviolet spectra; initial reporting listed Hertz and 11 other companies as customers, while later reporting added FedEx and hundreds of US cannabis dispensaries, and one report described a link to Planet13. Victims reportedly include journalist Brian Krebs and US Defense Secretary Pete Hegseth. Nexus went dark within hours of the initial report. The FBI has opened an official inquiry into the source of the images, and IDScan.net says it is investigating; as of 2026-09-04 it had issued no official statement. By 2026-09-07, at least four class-action lawsuits had been filed against IDScan.net in the US District Court for the Eastern District of Louisiana. Sources differ on scale: the Nexus listing claimed over 153 million licenses, while Infosecurity Magazine reported the FBI probe concerns possible exposure of as many as 170 million North Americans. Experts note that unlike passwords, the exposed license data (date of birth, address, ID numbers) cannot be changed, creating the potential for lifelong identity fraud.

• 2026-09-02: KrebsOnSecurity reported dark-web marketplace Nexus selling roughly 153 million driver's license scans, including the author's license scanned at a car rental hours earlier.
• Scans appeared within hours to one day of presentation and listings grew by about 400,000 in 24 hours, suggesting a near real-time, ongoing data leak.
• Nexus, a service on the Russian cybercrime forum Exploit, also claimed over 10 million ID cards, 3 million travel documents, and 579,000 medical cards for sale.
• KrebsOnSecurity traced the trove to New Orleans-based identity-verification firm IDScan.net; one report cited Hertz and 11 other companies as customers, another cited Hertz, FedEx, and hundreds of US cannabis dispensaries, and one…
• IDScan.net's ID scanning service captures infrared and ultraviolet spectra, per the initial report.
• Victims reportedly include journalist Brian Krebs and US Defense Secretary Pete Hegseth.
• Nexus went dark within hours of the 2026-09-02 disclosure.
• The FBI has opened an official inquiry into the source of the images and is investigating the incident.