153 million US and Canadian driver's license scans sold on dark web; FBI investigating IDScan.net breach
Dark-web market Nexus is selling 153M+ US and Canadian driver's license scans plus millions of other IDs and medical records. Live DB updates indicate an ongoing leak. Identity-verification vendor IDScan.net is cooperating; FBI confirmed involvement on September 2.
Independent journalist Brian Krebs reported on September 1 that a dark-web market named Nexus is selling more than 153 million electronic scans of US and Canadian driver's licenses, plus millions of other identity documents, travel documents, and hundreds of thousands of medical records. The FBI confirmed on September 2 that it is investigating. This may be one of the largest leaks of government-issued identity documents in North American history.
Incident overview
Krebs found Nexus ads on a Russian-language cybercrime forum, logged in, and confirmed the data is genuine. He verified with nine affected individuals. The site used his own driver's license as a free sample; a preview of the US Secretary of Defense's document was also present. Infoblox researcher Zach Edwards and several others verified the set and called the scale unprecedented. More critically, the site's database was updating in real time, indicating an active, ongoing leak. Shortly after Krebs published, the site went offline.
Technical details
The likely source is New Orleans-based identity-verification vendor IDScan.net. The firm processes more than 21 million identity checks per month for Fortune 500 banks, retail, and law enforcement, and is cooperating with the investigation. Document types listed on Nexus (driver's licenses, ID cards, travel documents, medical cards) match what that class of identity-verification platform collects. Stolen license scans are high-fidelity identity credentials and can directly support account opening, financial fraud, and Deepfake KYC-style attacks. For law-enforcement and military personnel, the leak is a concrete national-security risk. One reason the FBI is involved: some leaked documents are alleged to belong to agents. Reuters notes the ultimate origin of the stolen data cannot be independently confirmed.
Impact assessment
The incident again shows third-party identity-verification vendors as structural data amplifiers: one intermediary falls and tens of millions of government IDs are exposed at once. Affected individuals and issuing agencies have almost no direct relationship with the vendor; they neither knew nor could defend in advance. Once large volumes of document scans hit the black market, confidence of phishing, loan fraud, and account-takeover attacks rises sharply. Abuse can last years.
Remediation
- Individuals: provide license scans only when strictly necessary; freeze credit and dispute immediately on anomalous credit or account activity; watch for secondary phishing that impersonates identity-theft follow-up.
- Enterprises that depend on identity-verification services: immediately review vendor data-retention policy and security certifications; put retention period, encryption, and breach-notification duties in the contract.
- Verification platforms should minimize storage, encrypt scans, and audit access. Do not keep high-fidelity document images in a plaintext store.
- Detection: monitor dark-web channels for secondary circulation of related document data; correlate leaked records with customer complaints.
References
- Applied Tech: weekly security recap, week of September 4, 2026
- CyberSecBrief: daily security brief, September 4, 2026
- Global Times: FBI investigating 153 million driver's license leak