A massive trove of driver’s license scans—more than 153 million—has appeared for sale on the dark web. The cache was posted by a cybercrime service called Nexus, and appears to include individuals from both the United States and Canada. The FBI has initiated an investigation focused on IDScan.net, a company based in Louisiana that provides identity verification technology, following indications the breach may be tied to its systems.
The listings emerged on August 31 on a Russian-language forum known as Exploit. Nexus claimed its database also covers 10 million other government-issued IDs, over 3 million travel documents, at least 579,000 medical cards, and more. Drivers’ licenses form the core of the data, with U.S. records predominating but Canada—including nearly half a million from Ontario—represented as well. Each listing included scans of both sides of the licenses, plus infrared and ultraviolet layers used for verifying authenticity. Several images also carried date-and-time stamps, offering clues about when the documents were processed. Some users even matched these records to real-world activities—such as renting cars or traveling—based on the timestamps.
Suspected Connections to IDScan.net & FBI Involvement
IDScan.net offers identity verification services to thousands of businesses globally, handling millions of verifications every month. The nature of the exposed scans—including their layer types and the metadata—suggests the breach could leverage the tech involved in IDScan.net’s systems. The company has confirmed it is investigating whether unauthorized access occurred, but stresses that it has not yet verified a breach or determined what data was affected.
The FBI’s split into this case is significant. Unlike many breaches involving password theft—which can often be reset—once a driver’s license is compromised, the harm can’t be undone. Fake IDs, synthetic identities, and social engineering attacks can all exploit such material. While Nexus reportedly shut down its storefront after the story gained media attention, law enforcement experts warn the damage may already be widespread—data may have been copied, moved, or repackaged in other illicit markets.
Risks & Security Lessons
The exposure of front and back scans, with added UV and infrared variants, creates a rich trove for fraudsters aiming to pass as legitimate holders of identity. For many identity verification platforms and clients, those extra layers are part of the process to defend against forgeries—making their compromise particularly dangerous.
Security professionals emphasize that companies handling sensitive ID scans must strictly limit how long they retain images, encrypt stored copies, enforce tight access controls, and establish robust monitoring for unusual activity. The case serves as a warning that collecting ID documents comes with serious risks—and that the practices around storage and verification need to be built for threat models, not convenience.
It’s still unclear precisely how many records are implicated, and whether IDScan.net or another vendor is ultimately responsible. With the FBI now involved, more details may emerge—about whether the leak was an inside job, a hack, or the result of systemic vulnerability. Victims should assume records may circulate for some time and take precautions with personal data.
This event highlights how the digital capture of physical identity documents has become a high-value target. As remote verification grows across sectors like finance, travel, and healthcare, the stakes are rising sharply. Watch for new disclosures—both about how the breach occurred, and what protections organizations will put in place to guard against similar exposure.
