The FBI is investigating a report of a data breach involving the sale of digital scans of driver's licenses on the dark web. The agency stated it is "looking into the incident" but declined to provide further comment due to the ongoing nature of the investigation.

A dark web service named "Nexus" advertised the sale of digital scans of identity documents on August 31, 2026. The Nexus service claimed to possess more than 153 million driver’s licenses from the U.S. and Canada. The listing also included claims of possessing more than 10 million identification cards, more than three million travel documents or international IDs, and approximately 579,000 to 580,000 medical cards. The service was advertised on the Russian cybercrime forum Exploit.

Journalist Brian Krebs reported that his own driver’s license was offered as a free sample on the Nexus service. He confirmed the authenticity of nine leaked documents by contacting the individuals whose data was listed. The Nexus operators claimed the data was obtained through a live breach at a major identity verification company and had been exfiltrating new data for over a year. The Nexus site went offline shortly after Krebs published his report.

IDScan.net, an identity verification provider based in New Orleans, stated it is investigating the incident. The company performs more than 21 million verifications per month and provides identity-verification services to clients including Hertz, GameStop, and FedEx. Four class-action lawsuits were filed against IDScan.net in the US District Court for the Eastern District of Louisiana.

Krebs concluded that the documents were likely siphoned from IDScan.net. Timestamps on the leaked images corresponded to dates when victims traveled or rented vehicles. In one instance, Krebs and his mother handed their licenses to a Hertz rental car representative at the same time, and their image timestamps were seconds apart.

The leaked driver’s license images included front and back scans, as well as infrared and ultraviolet versions. Some records in the Nexus database listed their source as CDL, potentially referring to commercial driver’s licenses, while others listed CAC, potentially referring to Common Access Cards. The database also included marijuana dispensary cards.

The New Orleans field office of the FBI launched an official inquiry into the source of the images. James E. Lee, President of the Identity Theft Resource Center, stated that if the claims are true, the breach could be one of the most extensive single leaks of driver’s license data. Zach Edwards, a threat researcher at Infoblox, stated that there has never been a breach of driver’s licenses at this scale.

Why It Matters

Edgar Whitley, a Professor of Information Systems at LSE, stated that a breach involving ID images carries worse security risks than a breach involving ordinary personal data. "You can reissue a new password but not a new face," he said. Tim Rawlins, senior adviser and director at NCC Group, stated that organizations should design identity systems on the assumption that identity evidence may eventually be compromised.

Brian Krebs noted the limited options for individuals affected by such a breach. "There is no way to ‘protect’ yourself from someone else using a digital scan of your license if the company collecting the scans is relieved of them by hackers, apart from choosing not to have your ID scanned by anything or anyone," he said. He added, "It doesn’t bother me seeing my data out there because I’m used to that. But it’s more aggravating to see this information available on friends and family members." Krebs also warned that "This data set will continue to have massive value to the cybercriminal community for many years, and we are likely to see this service or one very similar appear again on the darknet."

Timeline

In 2023, hackers exploited a vulnerability in the MOVEit file-transfer system used by Louisiana’s Office of Motor Vehicles, affecting roughly 6 million records. On June 17, 2025, American Safety Holdings, LLC, a Louisiana Limited Liability Company-Acquisition of Property-American-International Travel, Inc. d/b/a Dixieland Tours & Cruises, a Louisiana Corporation — American Safety Holdings, LLC, a Louisiana Limited Liability Company-Acquisition of Property-American-International Travel, Inc. d/b/a Dixieland Tours & Cruises, a Louisiana Corporation. On June 17, 2025, American Safety Holdings, LLC (Holdings), a noncarrier, and its affiliate American Safety Transit, LLC (Transit), a motor passenger carrier, filed an application for control over substantially al. Also in 2025, on June 1, Brian Krebs and his mother handed their licenses to a Hertz rental car representative at the same time, and their image timestamps were seconds apart.

On the same date, the Nexus service claimed to possess more than 10 million identification cards.

What's New

Brian Krebs concluded that the documents were likely siphoned from IDScan.net.

IDScan.net states it performs more than 21 million verifications per month. Brian Krebs stated, "There is no way to ‘protect’ yourself from someone else using a digital scan of your license if the company collecting the scans is relieved of them by hackers, apart from choosing not to have your ID scanned by anything or anyone."