Malwarebytes FBI Investigates Nexus Selling 153M+ Driver's Licenses on Dark Web
Article Content
- •Nexus claims to sell over 153 million driver's licenses and millions of other IDs.
- •The FBI is investigating a potential breach linked to IDScan.net, a Louisiana-based identity verification provider.
- •The dataset includes sensitive information, raising significant identity theft concerns.
A dark web service named Nexus has emerged, claiming to sell over 153 million digital scans of driver's licenses from the U.S. and Canada, alongside millions of other identity documents. The FBI's New Orleans field office has initiated an investigation into the source of these images, which are suspected to be linked to a breach at IDScan.net, an identity verification provider. Nexus reportedly has been exfiltrating data for over a year, with the number of available records increasing rapidly. The dataset includes not only driver's licenses but also medical cards and travel documents, raising significant concerns about identity theft. The FBI's inquiry follows reports from KrebsOnSecurity, which traced some records back to individuals who recently used services requiring ID verification. IDScan.net is currently investigating the breach but has not confirmed its systems as the source of the data. The Nexus website has reportedly disappeared following the investigation's commencement.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (85)
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…
Korean-speaking Hackers Target PHP Vulnerabilities in Global Campaign A cybersecurity report from Cyfirma reveals that attackers, possibly linked to North Korea's Lazarus group, are preparing to exploit critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619). These vulnerabilities allow unauthenticated remote code execution, posing a significant threat to government…