A newly launched identity theft service operating on the dark web has begun selling digital scans of more than 153 million driver’s licenses belonging to residents across the United States and Canada. Based on investigative findings, interviews with affected individuals, and official law enforcement actions, the illicit repository appears to be systematically siphoning high-resolution identification images collected by a prominent, widely utilized identity verification company headquartered in Louisiana. The sudden emergence of this vast data trove has triggered an official federal inquiry led by the Federal Bureau of Investigation.
The operation came to light when a security source alerted investigative journalist Brian Krebs to a service advertised on the Russian-language cybercrime forum known as Exploit. The vendor offered access to digital scans of identity documents spanning more than 170 million people across North America. The source flagged the forum post because the threat actor operating the service had published the Virginia driver’s license of the journalist himself as a complimentary sample in their initial sales thread.
The illicit platform, operating under the moniker Nexus, claims to house over 153 million driver’s licenses from the United States and Canada. Furthermore, the database allegedly includes more than 10 million state and provincial identification cards, upwards of three million international travel documents and passports, and at least 579,000 specialized medical and dispensary cards.
A preliminary evaluation of the Nexus platform indicated that these staggering volume claims were likely accurate. Performing a blank search with zero parameters entered yielded approximately 11.5 million pages of results, averaging roughly 15 distinct records per page. While the repository contains records from both Canada and the United States, the overwhelming majority of the compromised data belongs to American citizens. Searches targeting Canadian credentials alone generated roughly 1.1 million results, with the highest concentration originating from the province of Ontario, which accounted for over 473,000 records.
Curiously, the harvested identity profiles encompass a diverse array of credentials beyond standard driver’s licenses. Entries include marijuana dispensary access cards, commercial driver’s licenses carrying the "CDL" source notation, and credentials marked with "CAC," an abbreviation that typically designates Common Access Cards—secure, government-issued identity cards utilized to grant physical entry to federal buildings and restricted military or governmental installations.
The threat actors behind Nexus asserted in their promotional forum posts that the document images originated from an active security breach at a major corporate identity verification enterprise whose extensive client roster includes multiple Fortune 500 companies. The operators boasted that they had been continuously exfiltrating fresh data into a private backend database for over a year, allowing prospective cybercrime buyers to preview redacted versions of records complete with customer photographs before completing a transaction. The dynamic nature of the leak was underscored by the platform’s metrics, which showed the driver’s license inventory expanding by nearly 400,000 records within a single 24-hour window, indicating that newly stolen identity documents were being harvested and integrated on a regular basis.
Forensic examination of the record featuring the journalist’s driver’s license revealed six distinct image files: three pairs depicting the front and back of the credential, a standard digital scan, alongside specialized infrared and ultraviolet versions of the same documents. Each image file contained embedded date and timestamp metadata. Notably, the timestamp on the journalist’s file corresponded precisely to a date in June 2025 when he had boarded a domestic flight to the midwest to attend a family funeral.
Determined to trace the origin of the leak, the investigation expanded to include more than a dozen friends and family members who consented to have their names searched within the Nexus database. Out of this group, nine individuals were successfully located, and every single one confirmed that they had traveled on dates matching or closely corresponding to the timestamps embedded in their respective image files. A review of car rental documentation and travel logs shared by participants suggested that the timestamps were recorded in Greenwich Mean Time.
Initial hypotheses centered on airports as the primary vector of compromise were quickly dismissed. The dataset contained zero passports, and several participants whose licenses appeared in the repository had not flown recently. For instance, one individual whose credential was discovered in Nexus had not taken any flights around the timestamp date, but had spent several months renting a vehicle from Hertz. Two other participants were federal employees who presented alternative government credentials at airport security checkpoints but subsequently handed over their state-issued driver’s licenses later that same day when renting vehicles at their destination, both utilizing Hertz.
Further personal recollection complicated the timeline. The journalist recalled that during his June 2025 flight from Reagan National Airport, he had never actually handed his driver’s license to Transportation Security Administration personnel because he had not yet acquired a Real ID, the security-enhanced credential required for domestic air travel. Instead, he presented his U.S. passport. However, his mother’s driver’s license was also discovered within the Nexus service, featuring timestamps separated by mere seconds from his own. Both individuals had presented their licenses simultaneously to a rental car representative behind a counter while executing paperwork.
The investigation soon intersected with other digital security researchers. Zach Edwards, a privacy researcher known for tracking online advertising practices through his project DecryptAds, discovered that his own driver’s license was available for purchase on Nexus. The timestamp on Edwards’s record corresponded to a trip to Las Vegas for the annual DEFCON security conference. While Edwards had not rented a vehicle during the trip, he had presented his license at an airport security checkpoint, his hotel, and a cannabis dispensary. Among those locations, only the dispensary—identified as Planet13, a multi-state chain operating stores in Nevada, California, Florida, and Illinois—was known to physically scan identification cards using dedicated hardware.
Publicly available corporate disclosures connected these dots further. In 2022, the New Orleans-based identity verification provider IDScan.net announced an exclusive partnership to manage identity verification across Planet13 dispensaries nationally. IDScan.net provides similar verification infrastructure for over 1,000 cannabis dispensaries spanning 19 states. Furthermore, the company’s corporate documentation indicates that it supplies verification technology to prominent national brands, including Hertz, Target, FedEx, Motorola Solutions, Jack Henry, and Caesars Entertainment. The company’s systems utilize infrared and ultraviolet scanning technology, processing more than 21 million verifications monthly across over 20,000 global locations.
When contacted by journalists, representatives from IDScan.net acknowledged that they were investigating the incident. Jillian Kossman, a marketing and operations leader at the firm, stated that the company was reviewing the information provided by researchers, though an official substantive statement was not immediately forthcoming.
As investigative inquiries widened, word of the potential data source reached the Federal Bureau of Investigation, spurred in part by the discovery that Nexus was offering the driver’s license of an assistant director of the FBI for sale. Senior leaders from the FBI’s cyber division convened a briefing with researchers, confirming that the agency’s New Orleans field office had officially launched an inquiry into an apparent security breach at IDScan.net.
Security experts interviewed during the investigation emphasized the profound societal risks posed by such large-scale credential leaks. Larry Baldwin, principal intelligence researcher at cybersecurity firm Cybera, noted that front and back scans of state-issued driver’s licenses are routinely accepted as primary authentication tokens when opening fraudulent lines of credit. Furthermore, Baldwin warned that the exposure endangers vulnerable populations who rely on anonymity, including survivors of domestic violence and individuals participating in the federal witness protection program, whose physical safety depends on untraceable identities that cannot be easily masked from advanced AI-based image-matching tools.
As the situation developed, corporate entities named in connection with the vendor’s partner list began issuing clarifications. A spokesperson for Caesars Entertainment stated that the hospitality giant had not been a client of IDScan.net and had ceased using its VeriScan software in February 2025, maintaining no active accounts at the time of the incident.
Days after the initial disclosures, IDScan.net published an official notification acknowledging that an unauthorized third party may have accessed and copied customer information, including full names and government-issued identification numbers, and stated that the company was actively notifying affected parties and providing credit protection services. Shortly following the publication of these findings, the Nexus dark web platform abruptly went offline, replacing its administrative login portal with a plain text notice declaring that the service was no longer available.
Leave a Reply