FBI Investigates Leak of 153 Million Driver's Licenses Traced to Identity Verification Vendor IDScan.net

FBI Investigates Leak of 153 Million Driver's Licenses Traced to Identity Verification Vendor IDScan.net A new dark web service named Nexus surfaced offering more than 153 million driver's license scans and other identity documents from the U.S. and Canada. Reporting linked the exposed records directly to idscan.net, prompting an official inquiry by the FBI's New Orleans field office and a subsequent breach acknowledgment from the vendor. Nexus advertised scans of over 170 million North American identity documents on the Russian cybercrime forum Exploit, claiming continuous data exfiltration for more than a year. Investigative testing showed timestamps on leaked records matched specific car rental transactions at Hertz and dispensary visits at Planet13, both clients of New Orleans-based idscan.net. The FBI's New Orleans field office opened an official inquiry into idscan.net, which subsequently acknowledged unauthorized access to customer identity data. Following publication, the Nexus dark web portal went offline, posting a message stating the service was no longer available. Discovery and Scope of the Nexus Service The dark web platform Nexus emerged on the Exploit cybercrime forum advertising scans of over 170 million identity documents, including more than 153 million driver's licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical cards. The service contained specialized documents such as commercial driver's licenses and marijuana dispensary cards, and blank searches indicated roughly 11.5 million result pages. Records contained regular photo scans alongside infrared and ultraviolet versions, with hundreds of thousands of new entries appearing daily. Tracing Data to Hertz, Planet13, and IDScan.net Cross-referencing leaked records belonging to the author, family members, and researcher Zach Edwards revealed that document timestamps aligned precisely with car rentals at Hertz or visits to Planet13 dispensaries. Both commercial entities utilize identity verification software provided by Louisiana-based idscan.net, which advertises technology that captures infrared and ultraviolet scans across more than 20,000 locations worldwide. Federal Investigation and Vendor Admission After discovering that Nexus also listed credentials for an assistant director of the FBI, senior cyber division leaders confirmed that the FBI's New Orleans field office initiated an official investigation into the breach at idscan.net. In a later notice, idscan.net acknowledged that an unauthorized third party may have accessed and copied customer names and government-issued identification numbers, prompting the vendor to offer credit monitoring. Security Implications and Aftermath Privacy experts cautioned that the compromise of high-fidelity driver's license scans exposes individuals to credit fraud and creates severe physical safety risks for protected individuals, including domestic violence survivors and witness protection participants. Furthermore, Caesars Entertainment stated it had ceased using idscan.net in February 2025 and did not authorize data retention, while the Nexus service completely vanished from the dark web shortly after the initial reporting.

暗网服务售卖逾1.53亿份驾照扫描件 FBI对身份验证服务商展开调查 暗网新平台Nexus被曝公开出售超过1.53亿份美加驾照等敏感身份证件扫描件。调查线索指向总部位于路易斯安那州的身份验证服务商idscan.net，美国联邦调查局（FBI）已介入展开正式调查。 暗网平台Nexus公开售卖逾1.53亿份驾照、千万份身份证件及大麻卡等扫描件，并包含红外和紫外扫描图像，声称数据源自对一家大型身份验证机构持续逾一年的渗透。 调查人员比对时间戳发现，受害者的泄露图像与在Hertz租车或Planet13大麻店出示驾照的时间吻合，而两家机构均使用idscan.net的双光谱扫描验证服务。 FBI新奥尔良办事处已对idscan.net的潜在数据泄露立案调查；idscan.net随后发布数据安全事件通知，Nexus网站亦迅速宣布关闭下线。 泄露规模与数据特征 暗网服务Nexus声称其数据库包含来自美国和加拿大的1.53亿余份驾照，此外还有逾1000万份身份证件、超300万份旅行或国际证件以及大麻配售卡等。样本记录显示，泄露文件包括证件正反面照片、红外与紫外扫描图及精确到秒的时间戳，且在调查期间平台数据量仍在以每日数十万条的规模持续增长。 溯源指向验证服务商idscan.net 多名受害者比对个人行程后确认，图像时间戳与他们在Hertz租车公司或大麻连锁店Planet13柜台出示证件的时间高度吻合，且部分人员在机场并未出示驾照。公开资料显示，新奥尔良身份验证技术公司idscan.net为Hertz、Planet13等多家企业提供支持紫外与红外扫描的身份核查服务，每月处理超2100万次验证。FBI新奥尔良办事处已据此对涉及该公司的泄露事件立案。 隐私风险与后续回应 安全专家指出，驾照图像常被用于开设信贷账户，其外泄不仅加剧金融诈骗风险，还可能危及受家庭暴力保护或联邦证人保护计划等群体的安全。idscan.net随后发布通知确认未授权第三方可能获取了客户姓名和证件号码等信息，并开始提供信用保护服务；涉事的暗网网站Nexus在事件曝光后不久已显示服务终止。

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that the New Orleans field office of the **Federal Bureau of Investigation** (FBI) today launched an official inquiry into the source of the images. On Monday, Aug. 31, a source alerted KrebsOnSecurity to a service advertised by a new user on the Russian cybercrime forum **Exploit**, offering access to digital scans of identity documents on more than 170 million people in North America. The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit. The service, dubbed **Nexus**, claims to have more than 153 million drivers licenses for people in the United States and Canada, as well as more than 10 million identification cards; more than three million travel documents and/or international IDs; and at least 579,000 medical cards. A quick look around Nexus finds they are likely not exaggerating about that 153 million number: Running a blank search in Nexus (with no search parameters entered) returns approximately 11.5 million pages of results, with roughly 15 results displayed per page. It includes documents from people in both Canada and the United States, but the bulk of these records are on Americans: searching for just Canadian drivers licenses returns approximately 1.1 million results, with the largest concentration from Ontario (473,673 records). Curiously, the identity records include not only drivers licenses but also marijuana dispensary cards. Some of the records list their “source” as “CDL,” presumably short for “commercial drivers license.” Other records carry the source notation of “CAC,” which may refer to Common Access Cards, government issued identity cards that grant physical access to government buildings and secure rooms. The people behind Nexus claim the license images are coming from an active breach at “a major identity verification company” whose customers include multiple Fortune 500 companies. “We have been continuously exfiltrating new data for over a year into our private database,” the service enthused in its introductory post on Exploit. “Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.” Indeed, over the past 24 hours, the number of drivers license records listed as available in Nexus has increased by nearly 400,000, suggesting that freshly stolen license data is being harvested and uploaded to this service on a semi-regular basis. The record featuring my drivers license includes six image files: three pairs of photos of the license’s front and back, a basic image scan, as well as infrared and ultraviolet versions of the same images. A date and timestamp is appended to each image file, and the timestamp on my license scan corresponds to a date in June 2025 when I took a flight to the midwest United States to attend a family funeral. Intent on discovering the source of this data, KrebsOnSecurity asked more than a dozen friends and family members for permission to search for their licenses in this service. Each person whose license could be found (nine of them) confirmed having traveled on or very close to the dates in the timestamps attached to their images. It is unclear what timezone these timestamps are in, but from reviewing car rental records shared by several people who helped with this research, it appears the timezone is set to Greenwich Mean Time (GMT). At first, I thought the source of the data might have something to do with airports. However, that theory went out the window when it became apparent there were no passports in this data set. Also, only some of those who helped with this research said they showed their drivers license at the airport on the day of their travel. One person whose license was in Nexus hadn’t flown at all recently, but was renting a car from **Hertz** for several months around the date of their timestamp. Two of those who agreed to help are federal employees who said they shared other forms of government identification when passing through airport security. However, those individuals each said they shared their state-issued drivers licenses later that day when renting vehicles at their respective destinations, and that both rented their cars from Hertz. After finding a note in my calendar for the day of my June 2025 flight reminding me to bring my passport, I remembered that I also never actually shared my drivers license when I went through security at Reagan National Airport on that day because I did not yet have a Real ID, a security-enhanced drivers license that is now required by the Transportation Security Administration (TSA) for all domestic travel. Instead, I showed the TSA agent my government-issued U.S. passport. Here’s where it gets interesting: I was able to find my mother’s drivers license in this service as well, and the timestamps for her images are just a few seconds apart from mine. That’s notable because we both handed our licenses to the Hertz rental car representative at the same time. According to my mom, the only place she gave her drivers license to that day was the rental car company, and if memory serves that is also true for me. I don’t recall if the rental car representative inserted our licenses into any kind of machine, but I remember they held onto them for several minutes behind the counter while we were signing various forms. KrebsOnSecurity sought comment from Hertz and will update this story in the event they reply. **Zach Edwards** is a well-known security and privacy researcher who recently launched a service called [DecryptAds](https://krebsonsecurity.com/2026/08/whos-tracking-you-use-this-new-service-to-find-out/) to help people better understand how online advertisers are tracking them. A scan of Edwards’s drivers license is available for purchase on this identity theft service, and Edwards said the timestamp on his record corresponds to the middle of a trip last month to Las Vegas for the annual DEFCON security conference. Edwards told KrebsOnSecurity that although he did not rent a car in Vegas, he did hand over his license at the TSA checkpoint, at a marijuana dispensary in Vegas, and at his hotel (the Aria). But he said the only one of those three that for sure scanned his ID in some kind of device was the dispensary. Edwards said the dispensary he visited that day was **Planet13**, a multi-state chain with stores in California, Florida, Illinois and Nevada. In 2022, the New Orleans-based identity provider **idscan.net** published [a press release](https://idscan.net/press-release/planet-13-partners-with-idscan-net/?srsltid=AfmBOooFV0QbsE8UCJBUhGP8mbYCl7j4iKJljXTf4NZA5n79ey00b5Qo) announcing an exclusive identity verification agreement with Planet13’s dispensaries nationally. IDScan says it processes ID verification for more than 1,000 marijuana dispensaries in 19 U.S. states. The “trust” page of idscan.net states that the company provides identity verification services for numerous big brands, including Hertz, **Target**, **Fedex**, **Motorola Solutions**, the financial services giant **Jack Henry**, and **Caesars Entertainment**. And as idscan.net’s own [documentation states](https://idscan.net/press-release/2025-id-fraud-report/), the technology scans IDs with both infrared and ultraviolet light. Idscan.net says the company’s systems and technology perform more than 21 million verifications monthly, at more than 20,000 locations around the world. Contacted by KrebsOnSecurity, idscan.net said it was investigating the matter, but the company has not yet shared an official statement or a substantive reply to specific questions sent via email. “At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation,” wrote **Jillian Kossman**, a marketing and operations leader at idscan.net. During the course of my research for this story, word got around to the FBI that I was poking at the apparent source of this new identity theft service’s data. Probably they were tipped off when I shared with a trusted source that Nexus also is selling the drivers license information for the assistant director of the FBI (I did not find FBI Director Kash Patel’s license in Nexus). Earlier this afternoon, I was added to a conference call with a half-dozen FBI agents, including senior leaders from the agency’s cyber division. During that call, the FBI shared that earlier today their New Orleans field office opened an official investigation into an apparent breach involving idscan.net. Edwards said that as more in-person and online experiences require sharing drivers licenses, vendors who collect this sensitive data need to be held to a higher standard. “This episode should further strengthen the resolve for people who are fighting back against online ID schemes which are requiring countless providers to ask for drivers licenses in order to access services under the guise of protecting kids,” Edwards told KrebsOnSecurity. “These systems are putting sensitive data into more and more 3rd party vendors, and we don’t have nearly the oversight to ensure they are safe.” **Larry Baldwin** is principal intelligence researcher at the cybersecurity firm [Cybera](https://www.cybera.io). Baldwin said a front and back scan of his drivers license available at Nexus contains timestamps that correspond to the date of a car rental from Hertz on a recent vacation. Baldwin said the Nexus identity theft service presents multiple serious security and privacy threats, noting that state-issued drivers licenses are commonly used as proof of one’s identity when opening new lines of credit. Baldwin said the service could also dangerously expose many people who do not wish to be found but who cannot meaningfully change their appearance (or at least not enough to fool today’s AI-based image matching tools). This category of people, he said, includes those fleeing domestic violence, and even people who have been assigned a whole new life and identity as part of the federal government’s witness protection program, which is generally reserved for criminal defendants in racketeering and conspiracy investigations who agree to cooperate with federal authorities. “Just when it seems like we’re making some headway in improving authentication controls through drivers license verification systems, this happens and the very thing those improvements are dependent on are compromised,” Baldwin said. **Update, Sept. 8:** IDscan.net published [a brief notice](https://idscan.net/notification-data-security-incident/) saying it has “determined that an unauthorized third party may have accessed and/or copied certain customer information, including full names and drivers license or other government-issued identification numbers.” The statement said IDscan.net is notifying affected individuals and offering credit protection services. **Update, Sept. 2, 6:05 p.m. ET:** A spokesperson for Caesars Entertainment said Caesars has not been a client of IDScan.net and has not used VeriScan since February 2025, despite IDScan.net listing them as a client on their website. That person said Caesars had no active VeriScan accounts at the time of the incident and did not authorize IDScan.net to retain data from its accounts, and that IDScan.net said the incident should have no impact on Caesars Entertainment. **Update, 8:56 p.m. ET:** Shortly after this story was published, the Nexus identity theft service website vanished from the darkweb, replacing its login page with a plain text message that reads, “This service is no longer available.” *This is a potentially fast-moving story. Any changes or updates will be noted here along with a timestamp.*