FBI probes IDScan.net breach as 153M+ driver's license scans sold on dark web Nexus service; class actions filed

A dark web marketplace service called Nexus offered over 153 million driver's license scans for sale, apparently taken in a near real-time breach of identity verification provider IDScan.net. The FBI's New Orleans field office is investigating, Nexus went…

A dark web marketplace service called Nexus, operating on the Exploit cybercrime forum, offered for sale more than 153 million driver's license scans — reported as mainly US and Canadian — plus over 10 million ID cards, 3 million travel documents, and 579,000 medical cards, including marijuana dispensary cards. KrebsOnSecurity traced the trove to New Orleans-based identity verification provider IDScan.net: scans contained front-and-back images plus infrared and ultraviolet spectra and timestamps matching holders' travel or car-rental activity, and new scans appeared within hours to a day of presentation, implying near real-time access to data flowing through IDScan.net's service; listings grew by about 400,000 in 24 hours, indicating an ongoing leak. IDScan.net's listed customers include Hertz and 11 other companies, with later reports adding FedEx and hundreds of US cannabis dispensaries. Named victims include US Defense Secretary Pete Hegseth and KrebsOnSecurity journalist Brian Krebs. Nexus went dark hours after the September 2 report, and the FBI's New Orleans field office opened an investigation; Infosecurity reported the incident may affect as many as 170 million North Americans. At least four class-action lawsuits have since been filed against IDScan.net in the US District Court for the Eastern District of Louisiana. Sources disagree on the company's public response: Malwarebytes and Infosecurity report IDScan.net says it is investigating, while CSO reported the company had not issued an official statement.

• Nexus, a service on the Exploit cybercrime forum, claimed for sale over 153 million driver's license scans (mainly US and Canadian), plus over 10 million ID cards, 3 million travel documents, and 579,000 medical cards, including marijuana…
• KrebsOnSecurity linked the trove to New Orleans-based identity verification provider IDScan.net, whose scanning service captures front-and-back images plus infrared and ultraviolet spectra, with timestamps matching holders' travel or…
• Scans appeared on Nexus within hours to a day of presentation, suggesting a near real-time data feed; license listings grew by about 400,000 over 24 hours, indicating the leak was ongoing.
• IDScan.net lists Hertz and 11 other companies as customers (Ars Technica); later reports add FedEx and hundreds of US cannabis dispensaries, and Krebs linked the leak to dispensary Planet13.
• Victims reportedly include US Defense Secretary Pete Hegseth and KrebsOnSecurity journalist Brian Krebs.
• Nexus went dark hours after KrebsOnSecurity's September 2, 2026 report; the FBI's New Orleans field office opened an investigation, and per CSO the FBI has formally requested information on the breach.
• Infosecurity Magazine reported the possible breach could affect as many as 170 million North Americans, versus the 153M+ licenses offered for sale.
• At least four class-action lawsuits were filed in the US District Court for the Eastern District of Louisiana against IDScan.net.