A newly launched identity theft operation on the dark web has begun selling digital scans of more than 153 million driver’s licenses belonging to residents of the United States and Canada. Based on independent analysis, security research, and interviews with individuals whose personal identification documents are currently listed for purchase, the service appears to be actively siphoning sensitive images originally collected by a prominent identity verification company headquartered in Louisiana. The sudden emergence of the platform has already prompted an official federal response, with the Federal Bureau of Investigation’s New Orleans field office launching an immediate inquiry into the source of the leaked data.
The operation came to light when a cybersecurity source alerted investigators to a newly advertised service hosted on a well-known Russian-language cybercrime forum called Exploit. The proprietor of the service was offering access to digital scans of identity documents spanning more than 170 million people across North America. The discovery took a personal turn for investigators when the dark web marketplace’s operator utilized a Virginia driver’s license belonging to security journalist Brian Krebs as a free promotional sample in their initial sales thread on the forum.
The Scale of the Nexus Identity Theft Service
The dark web service, operating under the name "Nexus," boasts an inventory of staggering proportions. According to its promotional materials and searchable database, the platform claims to offer more than 153 million driver’s licenses from the United States and Canada. In addition to standard state- and province-issued driving credentials, the service lists more than 10 million identification cards, upward of three million travel documents and international IDs, and at least 579,000 medical cards.
An initial technical review of the platform suggests these vast claims are largely accurate. Conducting a blank search on the Nexus database—leaving all search parameters empty—yields approximately 11.5 million pages of results, with roughly 15 records displayed per page. While the dataset contains information from both Canada and the United States, the overwhelming majority of the compromised records belong to American citizens. Searches restricted exclusively to Canadian driver’s licenses still return roughly 1.1 million results, with the highest concentration originating from the province of Ontario, which accounts for more than 473,000 individual records.
Intriguingly, the stolen identity records extend far beyond conventional driver’s licenses. The database includes specialized documents such as marijuana dispensary cards, commercial driver’s licenses labeled with the source code "CDL," and highly sensitive government credentials marked with the notation "CAC." The latter designation is widely believed to refer to Common Access Cards, which are physical identification tokens issued to military personnel and government contractors to grant secure physical access to federal buildings and restricted rooms.
Tracing the Breach Back to an Identity Verification Firm
The operators behind Nexus assert that the high-resolution license images are being funneled directly from an active, ongoing security breach at a major identity verification company whose extensive client roster includes multiple Fortune 500 corporations.
In their introductory post on the Exploit forum, the operators boasted about their methodology, explaining that they have been continuously exfiltrating fresh data into a private database for over a year. The platform allows prospective buyers to preview records before purchase with certain sensitive details redacted, while clearly displaying customer photographs whenever they are available in the source files. The dynamic nature of the leak is underscored by the platform’s daily growth; within a single 24-hour window, the number of available driver’s license records surged by nearly 400,000, indicating that newly harvested identity data is being systematically uploaded on a regular schedule.
Further examination of the compromised files reveals the high fidelity of the data being peddled. For instance, a record featuring a personal driver’s license contains six distinct image files. These consist of three pairs of photographs capturing both the front and back of the license, a basic flat image scan, and specialized infrared and ultraviolet versions of the exact same documents. Each image file is accompanied by an embedded date and timestamp. For several individuals who tested the system, these precise timestamps correlated cleanly with specific travel dates, such as a flight taken to the American Midwest for a family funeral or a trip to attend a cybersecurity convention.
By cross-referencing timestamps with travel itineraries, car rental agreements, and calendar reminders, researchers began to piece together how the data was captured. Notably, several individuals whose licenses appeared in the Nexus database had not actually presented their driver’s licenses at airport security checkpoints—often relying instead on U.S. passports due to Real ID enforcement rules. However, many of these same individuals had handed their physical driver’s licenses to rental car representatives at counters during the exact timeframe indicated by the file metadata. In multiple instances, travelers who rented vehicles together at the same desk found that their respective license scans bore timestamps that were mere seconds apart.
Attention quickly turned toward companies that process large volumes of in-person identity verification. Investigators highlighted idscan.net, a New Orleans-based identity verification provider that handles verification processes for thousands of commercial locations worldwide. The company’s technology is utilized across numerous industries, including major retail chains, financial services institutions, entertainment venues, and a vast network of cannabis dispensaries. Promotional materials and technical documentation from idscan.net explicitly note that their systems utilize specialized hardware capable of capturing infrared and ultraviolet scans of identification documents.
Federal Involvement and Broad Security Implications
As word of the sprawling database spread through security research circles, federal law enforcement took notice. The discovery that the service was offering digital scans of identification documents belonging to high-ranking government officials—including U.S. Defense Secretary Pete Hegseth and a senior assistant director of the Federal Bureau of Investigation—accelerated the response. Representatives from the FBI’s cyber division contacted investigators, confirming that the agency’s New Orleans field office had formally opened an official inquiry into the apparent security breach impacting idscan.net.
In the wake of these developments, idscan.net issued a brief public notification acknowledging that an unauthorized third party may have accessed and copied customer information, including full names and government-issued identification numbers. The company stated that it began notifying affected individuals and offering protective monitoring services. Meanwhile, other corporate entities named on the vendor’s client lists moved quickly to clarify their relationship with the firm, with a spokesperson for Caesars Entertainment stating that the hospitality giant had not been an active client of the verification provider and maintained no operational accounts at the time of the incident.
Cybersecurity experts have emphasized the severe risks posed by large-scale leaks of physical identification scans. State-issued driver’s licenses serve as a foundational pillar of identity verification across the modern economy, frequently acting as the primary proof of identity required to open lines of credit, access financial accounts, or verify legal status. Furthermore, researchers point out that the exposure of high-resolution biometric photographs and document scans presents profound privacy hazards for vulnerable populations, including individuals fleeing domestic violence or participants in specialized federal protection programs whose physical safety relies on maintaining obscurity from advanced digital recognition tools.
The sudden collapse of the infrastructure behind the leak matched its abrupt arrival. Shortly after initial reports and investigations were made public, the Nexus dark web service website went offline, replacing its login portal with a brief text message declaring that the service was no longer available. Despite the takedown of the portal, the incident has intensified scrutiny surrounding the pervasive collection and third-party storage of sensitive citizen data by private vendors under the banner of security and age verification.
