Security journalist Brian Krebs reported on Sept. 1 that a dark web identity-theft service called Nexus is selling more than 153 million digital scans of driver’s licenses from the United States and Canada. In a sales post on the Russian-language hacking forum Exploit, the seller wrote: "We have been continuously importing newly stolen data into our own database for more than a year." Krebs said the number of license records on the site increased by nearly 400,000 in just 24 hours while he was watching it.
Nexus listing includes IDs, travel documents and medical cards
The service is not limited to driver’s licenses. The listing also includes more than 10 million identity cards, more than 3 million travel documents and international identity papers, and at least 579,000 medical cards. The seller claimed the database covers more than 170 million people across North America.
Of the Canadian driver’s license records, about 1.1 million were tied to Canada, with roughly 470,000 from Ontario, the largest provincial share mentioned in the report.
Files include infrared and ultraviolet images
Krebs wrote that the records appear more complete than in a typical personal data breach. His own Virginia driver’s license entry contained six image files, with front and back images in separate sets. Alongside standard scans were infrared and ultraviolet versions, and the filenames included date and time stamps.
Malwarebytes said those infrared and ultraviolet images are used by verification systems to determine whether an ID is genuine. If scammers obtain them, the outlet said, it is effectively the same as handing over the answer key used to spot fake documents. Krebs noted that a leaked password can be changed, but a face, date of birth, home address and driver’s license number cannot.
Timestamps traced back to IDScan.net
Krebs said he worked backward from the timestamps. With permission from more than a dozen friends and relatives, he searched for their records and found that nine of them were present in the database. The timestamp on his mother’s files was only seconds apart from his because both had handed over their licenses at the same Hertz rental counter on the same day.
A separate lead came from security researcher Zach Edwards. His record carried a timestamp from a trip last month to Las Vegas for DEFCON. On that day, he had shown his license at airport security, a hotel and a cannabis dispensary, but he said the only place that had machine-scanned the document was Planet 13.
Both lines of inquiry pointed to the same company. IDScan.net, based in New Orleans, lists clients on its trust page that include Hertz, Target, FedEx, Motorola Solutions and financial services provider Jack Henry. The company says its systems process more than 21 million verifications each month across more than 20,000 locations worldwide, including more than 1,000 cannabis dispensaries in 19 states.
FBI has opened a case, company has not issued a formal statement
As of publication, IDScan.net had not released a formal statement. Jillian Kossman, the company’s head of marketing and operations, told Krebs: "At this stage I can’t provide more information, but the updates you shared are very helpful and useful to our team’s investigation." Chief executive Jimmy Roussel did not respond to questions from TechCrunch, and the company had not notified any individuals whose documents may have been scanned.
The FBI’s New Orleans field office opened a case on Sept. 1 over the suspected intrusion. Krebs said he was brought into a phone call that day with half a dozen agents, including senior officials from the cybercrime unit.
The records on sale were not limited to ordinary citizens. The Minnesota driver’s license of U.S. Defense Secretary Pete Hegseth was also included. Techdirt said that record was priced at $100.
Scope of exposure and the exchange KYC question
On the size of the leak, Nexus listed more than 153 million U.S. and Canadian driver’s licenses, 10 million identity cards and 3 million travel documents. The seller claimed the data covers more than 170 million people in North America. IDScan.net has not confirmed that figure.
The original report also raised the question of whether identity documents uploaded to cryptocurrency exchanges can be exposed in similar incidents. It cited a prior example: Coinbase disclosed in May 2025 that bribed customer support contractors caused a leak that included images of government-issued IDs, with 69,461 people reported as affected. The report said KYC files are often stored by third-party verification vendors.