153 million driver's license scans for sale: the Nexus case and the KYC data problem
In early September 2026, a darknet service called Nexus was offering searchable access to scans of more than 153 million driver's licenses from the United States and Canada, plus millions of other identity documents. Within days, the FBI's New Orleans field office had opened an official investigation into the source of the images, as first reported by KrebsOnSecurity. The FBI angle made headlines, but the deeper story is about infrastructure: the identity-verification systems behind KYC checks have become the darknet data trade's most durable targets.
What Nexus was selling
The advertised numbers were unusual even by darknet standards: over 153 million US and Canadian driver's licenses, more than 10 million ID cards, over 3 million travel documents or international IDs, and at least 579,000 medical cards. A blank search returned roughly 11.5 million pages of results, and the count grew by nearly 400,000 within 24 hours as the story was researched. The service was promoted on the Russian-language cybercrime forum Exploit, with the reporting journalist's own Virginia license offered as a free sample. Each record could include six image files: front and back of the license in normal light, plus infrared and ultraviolet versions of both, exactly the formats automated document checks look for. Dispensary cards sat in the inventory alongside licenses, some carrying source notations such as CDL or CAC. The timestamps told their own story: people who found their own licenses could match them to specific days, a Hertz car rental or a Las Vegas dispensary visit, when they had handed their ID to a clerk.The idscan.net connection
The trail pointed to idscan.net, a Louisiana-based identity verification company whose website lists brands including Hertz, Target, FedEx, Motorola Solutions, Jack Henry and Caesars Entertainment. It says its systems handle more than 21 million verifications a month at over 20,000 locations, including more than 1,000 dispensaries in 19 US states. KrebsOnSecurity concluded the data was likely siphoned from the platform. On September 8, idscan.net published a notice saying an unauthorized third party may have accessed and copied customer information, including full names and drivers license or other government-issued identification numbers, and said it was notifying affected individuals and offering credit protection. Caesars said it had not been a client since February 2025; the case drew international coverage, including from Germany's Tarnkappe. The FBI's New Orleans field office opened an official investigation, and SecurityWeek reported that some of the licenses apparently belonged to FBI employees. The Retail and Hospitality ISAC confirmed the service went dark shortly after the first reports, its login page replaced with a terse notice: "This service is no longer available." What the reporting does not say is what became of the copies already sold. A dataset of this size does not simply cease to exist because a storefront does.Why license scans are the trade's most durable commodity
Stolen passwords get rotated; stolen cards get reissued. A driver's license binds a largely fixed set of facts, full name, date of birth, home address, license number, to a photograph, and none of that can be changed in bulk after a breach. A license number follows a person for decades. That is what makes front-and-back scans captured in visible, infrared and ultraviolet light so valuable: they satisfy both the human and the machine side of identity checking. A single high-quality scan enables several distinct lines of attack:- Identity synthesis. License data combines well with other breached records to open bank or credit accounts, as Cybera researcher Larry Baldwin noted after finding his own scan on Nexus.
- Defeating document verification. Infrared and ultraviolet copies are what automated KYC systems check for, so a full scan supports account takeovers and fraudulent onboarding that a cropped photo cannot.
- Physical exposure. Records include photographs, so they feed image-matching tools. Baldwin warned the dataset could endanger people who cannot afford to be found, from those fleeing domestic violence to relocated witnesses.
- Social engineering. A real government ID in an attacker's hands makes impersonation attempts dramatically more convincing.
Organizations should design identity systems on the assumption that identity evidence may eventually be compromised. A genuine-looking document cannot remain sufficient proof of identity indefinitely.Security researcher Zach Edwards, whose own license surfaced on Nexus, drew a broader conclusion: every scheme requiring people to hand a license to a third-party service feeds these centralized pools, and oversight has not kept pace with how much data they store.
Harm reduction if your scan is in a dump
IDScan.net says it is notifying affected individuals and offering credit protection. But anyone who has handed a license to a rental counter, dispensary or hotel desk in North America has reason to assume a scan exists somewhere. Nothing below undoes a leak; all of it narrows what a buyer can do with one.- Freeze your credit with the major bureaus. A stolen license is far less profitable if no new line of credit can be opened in your name.
- Expect targeted phishing. Scammers quoting your real name, address and license number are not guessing; treat such messages as evidence of compromise.
- Ask before you hand anything over. Whether an ID can be checked without being scanned, photographed or retained is a fair question, and one SecurityWeek recommends posing.
- Refuse to complete the picture. An attacker holding your license will push for the missing pieces: codes, selfies, secondary documents. Those you can decline.