FBI Probes Nexus Over 153M US and Canadian Driver's Licenses

153 million licenses: Nexus claims to offer more than 153 million U.S. and Canadian driver’s license scans.

FBI Investigation: The FBI’s New Orleans field office has opened an investigation into the suspected source.

IDScan suspected: Evidence gathered by KrebsOnSecurity points to identity verification provider IDScan.net.

A newly surfaced dark web identity theft service is offering access to an enormous collection of U.S. and Canadian identity documents, including more than 153 million driver’s license scans. The service, known as Nexus, appeared on the Russian-language cybercrime forum Exploit and has prompted an investigation by the FBI.

The scale of the alleged dataset is significant, but the source and full extent of the compromise have not been officially established. Investigative evidence currently points toward IDScan.net, a Louisiana-based identity verification provider.

Nexus Advertises Millions of Identity Documents

Nexus claims its database contains information on more than 170 million people across North America:

153 million driver’s licenses,

10 million identification cards,

3 million travel documents and international IDs,

579,000 medical cards.

The service reportedly told Exploit users that it had been continuously exfiltrating new information for more than a year. Its advertised driver’s license total also increased by almost 400,000 records in a single 24-hour period, suggesting the database was still receiving new material when it was observed.

The records are not limited to basic text information. Some scans reportedly contain multiple images of the front and back of a license, including infrared and ultraviolet versions, along with timestamps.

Evidence Points to IDScan.net

KrebsOnSecurity traced a number of exposed records to individuals who had recently used services requiring physical identification checks. In several cases, timestamps associated with the leaked scans corresponded closely with activities such as car rentals and visits to identity-verification locations.

Those findings led to IDScan.net, whose technology is designed to capture and authenticate identity documents. The company's own documentation confirms that its systems process driver's licenses, passports, and other identity documents and can use multiple light sources, including infrared and ultraviolet imaging.

IDScan.net says its platform processes more than 21 million verifications each month across more than 20,000 locations, working with Hertz, Target, FedEx, Motorola Solutions, Jack Henry, and Caesars Entertainment.

IDScan.net has confirmed that it is investigating the matter but has not publicly established that its systems were the definitive source of the Nexus database.

Nexus Disappears After Investigation Begins

The FBI's New Orleans field office has now opened an official investigation into the apparent breach involving IDScan.net, according to reporting by KrebsOnSecurity. Shortly after the reporting appeared, the Nexus website disappeared from the dark web and was replaced by a message stating that the service was no longer available.

What Users Should Do Now

At this stage, users should avoid assuming that every person who has interacted with an IDScan.net-powered service is affected.

People who recently provided a driver's license to a rental company, retailer, dispensary, financial service, or other identity-verification provider should remain alert for unusual communications and be cautious unsolicited messages claiming to offer help following the breach.

In May, a Microsoft Azure server misconfiguration exposed 300,000 government-issued IDs in a PayTel data leak .