Nexus dark web service sells 153M+ driver's license scans; breach traced to IDScan.net as FBI investigates and class actions mount

A dark web service called 'Nexus', advertised on the Exploit cybercrime forum, offered scans of more than 153 million US and Canadian driver's licenses plus 10 million+ ID cards, roughly 3 million travel documents, and 579,000 medical cards, apparently…

On Sept 1, 2026, KrebsOnSecurity reported that a new dark web identity-theft service called Nexus, advertised on the Exploit forum, was selling scans of more than 153 million US and Canadian driver's licenses, over 10 million ID cards, millions of travel documents (reported as ~3 million by other outlets), and 579,000 medical cards including marijuana dispensary cards. The trove appeared to come from an ongoing breach at a major Louisiana-based identity verification company, with listings growing by about 400,000 licenses in 24 hours, indicating continuous exfiltration over roughly the past year. The scans included front-and-back images plus infrared and ultraviolet image pairs, and timestamps matched holders' travel and car-rental activity, suggesting near real-time capture; subsequent scans appeared within hours of being presented at a car rental. Notable victims included Defense Secretary Pete Hegseth and, per CSO Online, journalist Brian Krebs. The trove was traced to New Orleans-based IDScan.net, whose customers include Hertz (plus 11 other companies), FedEx, and hundreds of US cannabis dispensaries; Infosecurity Magazine separately cited figures suggesting the breach could affect as many as 170 million North Americans. The FBI's New Orleans field office opened an official inquiry into the source of the images. Nexus went dark within hours of the initial disclosure. IDScan.net says it is investigating, though as of Sept 4 it had not issued an official statement. Experts warned that stolen license data (name, DOB, address, ID numbers) is immutable and could enable lifelong identity fraud, and Malwarebytes advised consumers to question ID retention practices, prefer privacy-preserving age checks, and consider credit freezes.

• Dark web service 'Nexus' on the Exploit forum offered 153M+ US and Canadian driver's license scans for sale (first reported by KrebsOnSecurity on 2026-09-01)
• Also offered: 10M+ ID cards, ~3 million travel documents (one report says 'millions'), and 579,000 medical cards including marijuana dispensary cards
• Listings grew by ~400,000 licenses in 24 hours, indicating continuous exfiltration over the past year and an ongoing breach
• License scans included front-and-back images plus infrared and ultraviolet image pairs, with timestamps linked to travel and car-rental activity (e.g., Hertz)
• New scans appeared within hours of being presented at a rental counter, implying a near real-time data feed from IDScan.net's ID scanning service
• Breach source traced to New Orleans/Louisiana-based identity verification provider IDScan.net, which serves Fortune 500 customers; named customers include Hertz, FedEx, Planet13, and hundreds of US cannabis dispensaries
• Notable victims include US Defense Secretary Pete Hegseth and, per CSO Online, KrebsOnSecurity journalist Brian Krebs; Ars Technica's author also found his license for sale shortly after a car rental
• Infosecurity Magazine cited figures suggesting the breach could affect as many as 170 million North Americans, vs. the 153M+ license figure cited elsewhere