Dark Web Cache Exposes 153 Million Driver’s Licenses
Toggle Dark Mode
The US Federal Bureau of Investigation is reportedly investigating a massive identity theft as digital scans of over 153 million driver’s licenses recently went on sale on the dark web. In addition to driver’s licenses, other documents available via this massive security breach include identification cards, residence cards, medical cards, and more.
The licenses included in the massive database belong to US and Canadian citizens, and appear to have been stolen through a hacked identity verification service, reports Krebs on Security.
The publication was able to confirm the data cybercriminals claimed they held was legitimate, as the bad actors provided a scan of the publication’s owner Brian Krebs’ own driver’s license. They also provided evidence that supported the scans of other victims.
A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. KrebsOnSecurity also has learned that the New Orleans field office of the Federal Bureau of Investigation (FBI) today launched an official inquiry into the source of the images.
The identity theft service, known as Nexus, claims to have its hands on over 153 million driver’s licenses for people residing in the United States and Canada, as well as more than 10 million identification cards, over three million travel documents/international IDs, nearly 580,000 medical cards, and even marijuana dispensary cards.
Krebs said a quick look at the Nexus database revealed the bad actors weren’t exaggerating about the cache of personal IDs they currently hold. A search in Nexus with no search parameters entered should show all available entries, returning approximately 11.5 million pages of results, with an average of 15 results per page.
The documents included those from both the US and Canada, with the bulk of the information from US residents. A search for just Canadian records returns approximately 1.1 million results. The largest number of Canadian records are from Ontario residents, with 473,673 records.
The shadowy figures behind Nexus claim the license images are from an active breach at “a major identity verification company” that appears to be based in Louisiana, and whose customers include several Fortune 500 companies.
The bad guys apparently still have access to the breached source, as they have added nearly 400,000 new records in just the past 24 hours, saying, “We have been continuously exfiltrating new data for over a year into our private database. Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.”
Krebs says the information they have on him includes a timestamp on his license scan, which apparently resulted from a June 2025 flight he took to the midwest United States to attend a family funeral. The record that included his driver’s license also included three pairs of basic image scans of the license’s front and back, as well as infrared and ultraviolet versions of the same images.
He was also able to find his mother’s driver’s license in the Nexus service as well, and those images carried timestamps just a few seconds apart from his. Krebs notes that he and his mother both handed their licenses to a Hertz rental car representative at the same time. This leads him to believe that at least some of the data stems from a verification service used by rental car company Hertz.
The verification service in question is located in New Orleans, and has a client list that includes Hertz, Caesars Entertainment, FedEx, Motorola Solutions, and Target.
A scan of the driver’s license of well-known security and privacy researcher Zach Edwards is also available for purchase on the identity theft service. He says the timestamp of the purloined data matches that of a trip he took last month to Las Vegas for the annual DEFCON security conference.
He says that while he did not rent a car in Vegas, he did hand over his license at the TSA checkpoint, at his hotel (the Aria), and at a Las Vegas marijuana dispensary. But he said the only place his ID was scanned for sure was by a device at the dispensary.
The dispensary Edwards visited that day was Planet13, a chain with stores in California, Florida, Illinois and Nevada. A 2022 press release from New Orleans-based identity provider idscan.net announced an identity verification agreement with Planet13 for its dispensaries nationally. IDScan claims to process ID verification for over 1,000 marijuana dispensaries, located in 19 US states.
And, as you may have guessed, the company provides identity verification services for several other large companies, including (say it with me) Hertz, Caesars Entertainment, FedEx, Motorola Solutions, and Target. They also deal with the US Coast Guard and Waste Management.
Idscan.net’s documentation also mentions that the technology the firm uses includes scans of IDs with both infrared and ultraviolet light. The company claims to perform more than 21 million verifications monthly, at more than 20,000 locations around the world.
The New Orleans field office of the FBI on Monday launched an official inquiry into the source of the images. Then, shortly after the story about this was published by Krebs on Security, the Nexus identity theft service website vanished from the dark web. The site’s login page now shows only a message that reads, “This service is no longer available.”
