Back Feeds.Feedburner

153 Million Driver License Images Offered on Dark Web

Feeds.Feedburner •Ionut Arghire • September 3, 2026

A threat actor this week started offering on the dark web digital scans of over 153 million US and Canadian driver’s licenses.

The driver’s licenses emerged on an identity theft service called Nexus. Simultaneously, a threat actor started promoting the service on a Russian cybercrime forum, claiming the possession of the IDs of over 170 million individuals.

On Nexus, visitors could find over 153 million driver’s licenses, more than 10 million identification cards, over 3 million travel documents and international IDs, and roughly 580,000 medical cards.

According to investigative journalist Brian Krebs, a blank on Nexus appeared to return approximately 153 million results. Only around 1.1 million driver’s licenses were from Canada.

The threat actor behind Nexus alleged that the documents were exfiltrated from an active breach at an identity verification firm that serves multiple Fortune 500 companies, Krebs reports .

After verifying the presence of his own driver’s license on Nexus, as well as that of other individuals, Krebs concluded that the documents were likely siphoned from identity verification platform IDScan.net.

The Louisiana-based firm provides ID fraud prevention, access management, and age verification services, along with an ID-activated door lock and mobile ID scanners.

The company says it works with large brands across a dozen industries, including automotive, banking and fintech, gaming, education, transportation, hospitality, law enforcement, retail, and security, performing over 21 million verifications each month at more than 20,000 locations.

SecurityWeek has emailed IDScan for a statement on the potential data breach and will update this article if the company responds.

According to Krebs, the Nexus platform was shut down shortly after his article on the stolen IDs was published.

However, the FBI apparently caught wind of the potential IDScan data breach and launched an official investigation into the matter. Some of the driver’s licenses the threat actor behind Nexus had exfiltrated apparently belong to FBI agents.

“The first takeaway lesson is that organizations should design identity systems on the assumption that identity evidence may eventually be compromised. A genuine-looking document cannot remain sufficient proof of identity indefinitely. Organizations should inventory identity data and establish who collects it, why it is needed, where it flows, and when it is deleted,” NCC Group senior adviser and director Tim Rawlins said.

“Contracts with identity providers should establish requirements for logging, data segregation, retention, incident notification, access to evidence, and independent assurance. Organizations should also monitor for abnormal bulk access and potential data exfiltration, including unusual activity involving service accounts, application programming interfaces, and administrative accounts,” Rawlins added.

Individuals should avoid sharing copies of their driver’s licenses unless absolutely necessary and, when presenting an ID for verification, ask whether it can be checked without being scanned, photographed, or retained.

Related: Ransomware Gang Claims Nutex Health Data Breach

Related: 9.5 Million Impacted by Aesto Health Data Breach

Related: McKesson Confirms Data Breach as Attacker Deadline Looms

Related: Extortion Group Claims Manchester Airports Group Data Breach

Ionut Arghire is an international correspondent for SecurityWeek.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FBI Investigates Nexus Selling 153M+ Driver's Licenses on Dark Web A dark web service named Nexus has emerged, claiming to sell over 153 million digital scans of driver's licenses from the U.S. and Canada, alongside millions of other identity documents. The FBI's New Orleans field office has initiated an investigation into the source of these images, which are suspected to be linked to a breach at IDScan.net, an identity verification provider. Nexus reportedly has been exfiltrating data for over a year, with the number of available records increasing rapidly. The dataset includes not only driver's licenses but also medical cards and travel documents, raising significant concerns about identity theft. The FBI's inquiry follows reports from KrebsOnSecurity, which traced some records back to individuals who recently used services requiring ID verification. IDScan.net is currently investigating the breach but has not confirmed its systems as the source of the data. The Nexus website has reportedly disappeared following the investigation's commencement. 59 sources 71

Extracted Entities

153 Million Driver License Images Offered on Dark Web

The full story

Extracted Entities

Attack Types (1)

Countries (1)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)