FBI probes Nexus sale of 153M drivers licenses tied to IDScan

A dark-web service called Nexus began selling digital scans of more than 153 million drivers licenses from people in the United States and Canada, along with more than 10 million ID cards, three million travel documents and 579,000 medical cards, Krebs on Security reports.

The service surfaced on the Russian cybercrime forum Exploit on August 31. "We have been continuously exfiltrating new data for over a year into our private database," the seller wrote in its introductory post. Journalist Brian Krebs, whose own Virginia license was offered as a free sample, was later added to a conference call with "a half-dozen FBI agents, including senior leaders from the agency's cyber division"; the bureau's New Orleans field office has opened a case.

The trail points to IDScan.net, a New Orleans identity-verification firm that performs about 21 million verifications a month for clients including Hertz, Target, FedEx, Motorola Solutions, Jack Henry, Caesars Entertainment and the dispensary chain Planet13. Timestamps on the stolen images matched the dates people had handed IDs to IDScan.net customers, and the leaked files carried the infrared and ultraviolet scans specific to IDScan.net's pipeline. Reached for comment, spokesperson Jillian Kossman said, "At this point I'm not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team's investigation."

Among the licenses Krebs found in the database were those of Defense Secretary Pete Hegseth, DecryptAds founder Zach Edwards and Cybera's Larry Baldwin. "This episode should strengthen the resolve for people fighting back against online ID schemes requiring countless providers to ask for drivers licenses in order to access services," Edwards said. Baldwin's license was tied to a Hertz rental; Edwards traced his own exposure to a Las Vegas dispensary. It lands in a stretch where our cybersecurity desk has logged 242 stories in 90 days, most recently Aurora ransomware's use of Cursor and Claude Sonnet against 20+ organizations.

That same day, Nexus went dark, replaced with a one-line notice: "This service is no longer available."