A dark web identity theft service named Nexus appeared on 1 September 2026 offering searchable access to more than 153 million scanned driver’s licences from the United States and Canada, along with other ID documents. The FBI’s New Orleans field office opened a formal investigation on the same day. The outlet KrebsOnSecurity traced the source to idscan[.]net, a New Orleans-based identity verification company whose clients include Hertz, Target, FedEx, Motorola Solutions, Caesars Entertainment and Jack Henry.
The Nexus claims a population base of over 153 million US and Canadian licences, plus more than 10 million ID cards, over three million travel/ID documents and at least 579,000 medical cards, with the total rising by roughly 400,000 per day as the breach appeared to be ongoing.
Evidence cited in the report includes the operators displaying samples of real licences on the Exploit dark web forum, and the discovery of the vendor’s data in Krebs’s own records. Krebs found his Virginia licence in the dataset, with a timestamp aligning to a June 2025 flight and car rental, and similar timestamps matched when testing with other individuals.
Security researchers noted that licences appear with multiple image formats (front/back in visible, infrared, and ultraviolet light) and timestamps, suggesting live exfiltration from a breach that allegedly began over a year earlier. Idscan[.]net said it would cooperate with law enforcement and forensic experts, but publicly disclosed little more.
The Nexus service subsequently went offline after the publicity, while the FBI continued its investigation into the breach and its potential link to government-issued documents.