The Federal Bureau of Investigation launched an inquiry after a newly launched dark web service offered digital scans of over 153 million driver’s licenses from the United States and Canada for sale, allegedly siphoning data from a Louisiana-based identity verification company.
A massive cache of North American identification documents has surfaced on the dark web, triggering a federal probe and raising urgent security questions for millions of drivers. On Monday, Aug. 31, a source alerted KrebsOnSecurity to a service advertised by a new user on the Russian cybercrime forum Exploit, offering access to digital scans of identity documents on more than 170 million people in North America. The illicit service, operating under the name Nexus, appeared on the forum offering searchable access to tens of millions of records containing sensitive personal data.
Security researchers discovered that the trove includes a record available at this identity theft service that includes the drivers license for U.S. Defense Secretary Pete Hegseth, one of several high-ranking U.S. government officials whose drivers licenses can be found for sale.
Federal Bureau of Investigation Opens New Orleans Inquiry
The New Orleans field office of the Federal Bureau of Investigation today launched an official inquiry into the source of the images. A spokesperson for IDScan.net, an identity verification provider based in New Orleans, told Krebs that the service was investigating the incident. The company works with marijuana dispensaries across the U.S. to validate IDs, as well as other businesses requiring ID verification spanning retail, transportation, finance, and other services.
The company provides ID validation services to marijuana dispensaries, retail outlets, transportation networks, and financial institutions across the United States.
Operators behind the illicit portal claimed in their introductory post on Exploit: We have been continuously exfiltrating new data for over a year into our private database.
What the Nexus Dark Web Service Claims to Hold
Running a blank search in Nexus (with no search parameters entered) returns approximately 11.5 million pages of results, with roughly 15 results displayed per page, matching the proprietors’ claims of immense scale.
- The service, dubbed Nexus, claims to have more than 153 million drivers licenses for people in the United States and Canada
- More than 10 million identification cards
- More than three million travel documents and/or international IDs
- At least 579,000 medical cards
Canadian records alone account for roughly 1.1 million results, with the largest concentration from Ontario (473,673 records). Curiously, the identity records include not only drivers licenses but also marijuana dispensary cards. Some of the records list their “source” as “CDL,” presumably short for commercial drivers license.
Other records carry the source notation of “CAC,” which may refer to Common Access Cards, government issued identity cards that grant physical access to government buildings and secure rooms.
Timestamps Reveal Travel Patterns and Data Harvest Rates
The record featuring my drivers license includes six image files: three pairs of photos of the license’s front and back, a basic image scan, as well as infrared and ultraviolet versions of the same images. A date and timestamp is appended to each image file, and the timestamp on my license scan corresponds to a date in June 2025 when I took a flight to the midwest United States to attend a family funeral.
Each person whose license could be found (nine of them) confirmed having traveled on or very close to the dates in the timestamps attached to their images. It is unclear what timezone these timestamps are in, but from reviewing car rental records shared by several people who helped with this research, it appears the timezone is set to Greenwich Mean Time (GMT).
The scale of the repository continues to expand dynamically. Indeed, over the past 24 hours, the number of drivers license records listed as available in Nexus has increased by nearly 400,000, suggesting that freshly stolen license data is being harvested and uploaded to this service on a semi-regular basis.
Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.
There have been confirmed breaches with larger reported victim or record counts. For example, in 2013, Yahoo suffered a breach affecting all three billion user accounts at the time, and in 2018, the global hotel chain Marriott disclosed a breach of its Starwood reservation database that affected hundreds of millions of guest records. But the potential Nexus breach could be one of the largest involving government IDs. It is also notable as the service reportedly claimed to provide a searchable trove of ID scans, including both front and back images, and infrared and ultraviolet scans of the IDs.
Продолжение темы
