/
← Voltar ao feed
critical identity verification car rental cannabis retail government gaming and hospitality

Nexus dark web service sells 153M+ US/Canada driver's license scans allegedly stolen from IDScan.net; FBI opens probe

1 fonte(s) · 1 atualização(ões) · publicado 01/09/2026 19:40 · coletado há 1 dia

A new dark web identity theft service called Nexus, advertised on the Russian cybercrime forum Exploit on Aug. 31, 2026, is selling scans of more than 153 million driver's licenses from the US and Canada. It also lists over 10 million ID cards, 3 million travel documents and 579,000 medical cards. KrebsOnSecurity's analysis points to the New Orleans-based identity verification provider IDScan.net as the source. The FBI New Orleans field office opened an official investigation into an apparent breach of the company. The Nexus operators claim they have been exfiltrating data for over a year from an active breach at "a major identity verification company". Shortly after the story was published, the Nexus site went offline, and on Sept. 8 IDScan.net acknowledged that an unauthorized third party may have accessed customer information.

Technical Details

  • Nexus offers searchable records with redacted previews. The record count grew by about 400,000 in 24 hours, which suggests ongoing harvesting.
  • Records include six image files per license: front and back photos, a basic scan, and infrared and ultraviolet versions. Each carries a timestamp, apparently in GMT.
  • Some records carry source labels "CDL" and "CAC" and include marijuana dispensary cards. Records of high-ranking US officials, including the Defense Secretary and an FBI assistant director, are listed.
  • Attribution to IDScan.net rests on correlation. Nine people whose licenses were in Nexus confirmed that the timestamps matched dates they presented their ID to a customer of IDScan.net, mostly Hertz car rentals and a Planet13 dispensary. No passports were in the data set, which ruled out airports.
  • IDScan.net's site lists clients such as Hertz, Target, FedEx, Motorola Solutions, Jack Henry and Caesars Entertainment. The company says it performs more than 21 million verifications monthly at over 20,000 locations. Caesars said it has not been a client and has not used VeriScan since February 2025.
  • The exposed data includes full names and driver's license or other government ID numbers, per IDScan.net's notice. The intrusion vector has not been disclosed.

Remediation

  • IDScan.net is notifying affected individuals and offering credit protection services.
  • Affected individuals should monitor credit and consider credit freezes. Organizations relying on driver's license images for identity proofing should reassess verification controls and third-party data retention.
  • Vendors that collect ID images should minimize retention and be held to stronger oversight.

Linha do tempo

  1. krebsonsecurity.com ↗ · pub. 01/09/2026 19:40 · coletado 19/10 17:56 primeiro registro

    Nexus dark web service sells 153M+ US/Canada driver's license scans allegedly stolen from IDScan.net; FBI opens probe

    ler a análise desta fonte

    A new dark web identity theft service called Nexus, advertised on the Russian cybercrime forum Exploit on Aug. 31, 2026, is selling scans of more than 153 million driver's licenses from the US and Canada. It also lists over 10 million ID cards, 3 million travel documents and 579,000 medical cards. KrebsOnSecurity's analysis points to the New Orleans-based identity verification provider IDScan.net as the source. The FBI New Orleans field office opened an official investigation into an apparent breach of the company. The Nexus operators claim they have been exfiltrating data for over a year from an active breach at "a major identity verification company". Shortly after the story was published, the Nexus site went offline, and on Sept. 8 IDScan.net acknowledged that an unauthorized third party may have accessed customer information.

    Technical Details

    • Nexus offers searchable records with redacted previews. The record count grew by about 400,000 in 24 hours, which suggests ongoing harvesting.
    • Records include six image files per license: front and back photos, a basic scan, and infrared and ultraviolet versions. Each carries a timestamp, apparently in GMT.
    • Some records carry source labels "CDL" and "CAC" and include marijuana dispensary cards. Records of high-ranking US officials, including the Defense Secretary and an FBI assistant director, are listed.
    • Attribution to IDScan.net rests on correlation. Nine people whose licenses were in Nexus confirmed that the timestamps matched dates they presented their ID to a customer of IDScan.net, mostly Hertz car rentals and a Planet13 dispensary. No passports were in the data set, which ruled out airports.
    • IDScan.net's site lists clients such as Hertz, Target, FedEx, Motorola Solutions, Jack Henry and Caesars Entertainment. The company says it performs more than 21 million verifications monthly at over 20,000 locations. Caesars said it has not been a client and has not used VeriScan since February 2025.
    • The exposed data includes full names and driver's license or other government ID numbers, per IDScan.net's notice. The intrusion vector has not been disclosed.

    Remediation

    • IDScan.net is notifying affected individuals and offering credit protection services.
    • Affected individuals should monitor credit and consider credit freezes. Organizations relying on driver's license images for identity proofing should reassess verification controls and third-party data retention.
    • Vendors that collect ID images should minimize retention and be held to stronger oversight.