A dark web service named Nexus is offering access to over 153 million scanned driver’s licenses from the US and Canada. This service emerged on September 1, 2026, leading the FBI to investigate a suspected breach at IDScan.net, an identity verification company linked to the stolen data. Security researcher Brian Krebs uncovered that the service was advertising the availability of these licenses, and confirmed the presence of his own license in the database.
The compromised data is believed to be linked to ongoing breaches and includes not only driver’s licenses but also ID cards, travel documents, and medical cards.
The investigation revealed that each license scan included comprehensive images captured under different lighting conditions, and many individuals confirmed their licenses were accessed during notable events. This incident highlights significant vulnerabilities in identity verification systems, which often create and store sensitive data without sufficient security oversight.