On Monday, Aug. 31, a new identity theft service called Nexus appeared on the Russian cybercrime forum Exploit, offering digital scans of more than 153 million driver's licenses from people in the United States and Canada. The service also lists over 10 million identification cards, more than three million travel documents or international IDs, and at least 579,000 medical cards, according to a KrebsOnSecurity investigation published Sept. 1.
The New Orleans field office of the Federal Bureau of Investigation opened an official inquiry the same day into the source of the images, which KrebsOnSecurity reports appear to originate from an active breach at IDScan.net, a Louisiana-based identity verification company whose clients include Hertz, Target, FedEx, Motorola Solutions, Jack Henry, and Caesars Entertainment.
What's new
- Service name: Nexus, advertised on the Exploit forum by a new user.
- Scale: 153,347,439 driver's license records; 10,335,678 identification cards; 3,000,000+ travel documents/international IDs; 579,000+ medical cards.
- Data freshness: Driver's license count grew by nearly 400,000 records in 24 hours, suggesting ongoing exfiltration.
- Image detail: Many records include six image files per license — front/back scans plus infrared and ultraviolet captures — with GMT timestamps attached to filenames.
- Notable records: Licenses for U.S. Defense Secretary Pete Hegseth, the FBI assistant director, and KrebsOnSecurity editor Brian Krebs were found in the database.
- Source indicators: Some records tagged "CDL" (commercial driver's license) or "CAC" (Common Access Card, used for government facility access).
How the source was traced
KrebsOnSecurity interviewed nine individuals whose licenses appeared in Nexus. Each confirmed traveling or renting a vehicle on or near the timestamp dates attached to their records. Two federal employees said they used government IDs at airport checkpoints but later presented their state driver's licenses when renting cars from Hertz. Krebs and his mother both found their licenses in the database with timestamps seconds apart, matching the moment they handed licenses to a Hertz rental agent.
Security researcher Zach Edwards, whose license timestamp aligned with a trip to Las Vegas for DEFCON, noted the only venue that definitively scanned his ID was the Planet13 marijuana dispensary. IDScan.net announced an exclusive verification agreement with Planet13 nationally in 2022 and states it processes ID verification for more than 1,000 dispensaries across 19 states. IDScan's own documentation confirms its technology scans IDs with both infrared and ultraviolet light — matching the image types found in Nexus.
IDScan.net's "trust" page lists Hertz, Target, FedEx, Motorola Solutions, Jack Henry, and Caesars Entertainment as clients. The company says it performs more than 21 million verifications monthly at over 20,000 locations worldwide.
Why it matters
Driver's licenses are a primary credential for opening new lines of credit, and the infrared/ultraviolet scans in Nexus could enable high-quality counterfeit production. Larry Baldwin, principal intelligence researcher at Cybera, warned the service also endangers people who cannot easily change their appearance — including domestic violence survivors and participants in the federal witness protection program — because modern AI-based image matching can link compromised photos to new identities.
The breach highlights systemic risk in the growing ecosystem of third-party identity verification vendors. As more in-person and online services require license scans, sensitive biometric data concentrates in companies that may lack adequate oversight.
Our take
The Nexus case shows how a single verification vendor can become a choke point for millions of identities across unrelated industries — car rental, cannabis retail, hospitality, and finance. Regulatory frameworks have not kept pace with the proliferation of ID-scanning kiosks and mobile SDKs that feed centralized databases. Until liability and audit standards catch up, every new integration expands the blast radius of the next breach.
