A new storefront for stolen identities
On August 31, 2026, a seller on the Russian-language cybercrime forum Exploit began advertising a new dark web service called Nexus, according to reporting by Brian Krebs. The pitch was blunt: identity documents covering more than 170 million people, ready to buy. By the time researchers and journalists got a look inside, the numbers matched the boast. Nexus held scans of over 153 million United States (US) and Canadian driver's licenses (about 1.1 million of them Canadian), more than 10 million other identification cards, upwards of 3 million travel and international documents, and roughly 580,000 medical and dispensary cards, per figures reported by SecurityWeek and Malwarebytes.
The seller wasn't sitting on a static dump. Krebs reported the inventory grew by around 400,000 licenses in a single 24-hour window while he was watching, suggesting live or near-live access to whatever system was feeding it. Nexus went offline shortly after his report and SecurityWeek's followed, on September 2 and 3 respectively.
Why these particular scans are worse than a typical leak
Most identity leaks are flat images or database fields: a name, a number, a photo. What made the Nexus listings unusual is that many records included front-and-back captures plus infrared and ultraviolet scans, the same layered imaging that physical identification (ID) scanners use to check a card is genuine, complete with timestamps, Krebs and Malwarebytes both reported. Those timestamps weren't incidental. Krebs found they lined up with real events in victims' lives, including dates they had rented cars from Hertz or visited marijuana dispensaries, which makes the data far more useful for building a convincing fraudulent identity than a stolen photo alone.
Where the trail leads
All roads in the reporting point to IDScan.net, a Louisiana-based identity verification vendor. SecurityWeek and Krebs both describe a company that processes more than 21 million verifications a month across upwards of 20,000 physical locations, serving clients Krebs named as including Hertz, Target, FedEx, Motorola Solutions, Jack Henry, Caesars Entertainment, and dispensary chain Planet13. Caesars told Krebs it stopped using IDScan.net's VeriScan product in February 2025, meaning at least some of the exposed data predates that cutoff.
IDScan.net has not confirmed a breach outright. Its marketing director, Jillian Kossman, told Krebs only: "At this point I'm not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team's investigation." SecurityWeek reported it also reached out to the company and received no response before publication.
Federal involvement
The Federal Bureau of Investigation's New Orleans field office, which covers IDScan.net's home state, opened an investigation, according to SecurityWeek. One detail reportedly accelerated the response: some of the leaked driver's licenses belonged to the FBI's own agents.
SecurityWeek quoted Tim Rawlins of NCC Group on the broader lesson: "Organizations should design identity systems on the assumption that identity evidence may eventually be compromised." That's a notable statement given that the entire business of a company like IDScan.net is convincing other businesses their identity checks are trustworthy.
The retention problem behind the breach
The deeper issue isn't just that a vendor got breached, it's how long that vendor was apparently holding onto scans in the first place. Age and identity verification is typically pitched to consumers as a one-time check: show your ID, get waved through, move on. But that only works as a privacy-preserving model if the underlying image doesn't linger in a database indefinitely. A rental car company or a dispensary has no obvious reason to need a renter's or customer's ID scan retrievable years later, yet the timestamps in the Nexus data suggest exactly that kind of long retention.
What this means in practice
If you've rented a car, visited a dispensary, or gone through age verification anywhere in the US or Canada in recent years, there's a real chance your driver's license image is among the exposed records, even if you never dealt with IDScan.net by name; most consumers never see the third-party vendor behind a business's ID check. Malwarebytes recommends asking any business that scans your ID whether it retains the image and for how long, and choosing verification methods that confirm an attribute (such as being over 21) without uploading a full ID scan when that option exists. It's also worth watching for phishing attempts and unexpected credit applications in the coming months, since a scan with infrared and ultraviolet security-feature data attached is more convincing to a fraud reviewer than a plain photo, and freezing your credit is a low-cost way to blunt the most common follow-on abuse of a stolen identity document.
