A brand new id theft service launched on the darkish internet this week is promoting digital scans of greater than 153 million drivers licenses from individuals in the USA and Canada. Primarily based on interviews with people whose licenses can be found for buy on this service, it seems to be siphoning pictures collected by a widely-used id verification firm based mostly in Louisiana. KrebsOnSecurity additionally has discovered that the New Orleans discipline workplace of the Federal Bureau of Investigation<\/strong> (FBI) at present launched an official inquiry into the supply of the photographs.<\/p>\n A document out there at this id theft service that features the drivers license for U.S. Protection Secretary Pete Hegseth, who’s one in every of a number of high-ranking U.S. authorities officers whose drivers licenses may be discovered on the market.<\/p>\n<\/div>\n On Monday, Aug. 31, a supply alerted KrebsOnSecurity to a service marketed by a brand new consumer on the Russian cybercrime discussion board Exploit<\/strong>, providing entry to digital scans of id paperwork on greater than 170 million individuals in North America. The supply introduced it to my consideration as a result of the proprietor of this id theft service supplied my Virginia drivers license as a free pattern of their preliminary gross sales thread on Exploit.<\/p>\n The service, dubbed Nexus<\/strong>, claims to have greater than 153 million drivers licenses for individuals in the USA and Canada, in addition to greater than 10 million identification playing cards; greater than three million journey paperwork and\/or worldwide IDs; and not less than 579,000 medical playing cards.<\/p>\n A fast go searching Nexus finds they’re probably not exaggerating about that 153 million quantity: Operating a clean search in Nexus (with no search parameters entered) returns roughly 11.5 million pages of outcomes, with roughly 15 outcomes displayed per web page. It contains paperwork from individuals in each Canada and the USA, however the bulk of those data are on Individuals: trying to find simply Canadian drivers licenses returns roughly 1.1 million outcomes, with the most important focus from Ontario (473,673 data).<\/p>\n Curiously, the id data embrace not solely drivers licenses but additionally marijuana dispensary playing cards. A number of the data record their \u201csupply\u201d as \u201cCDL,\u201d presumably quick for \u201cbusiness drivers license.\u201d Different data carry the supply notation of \u201cCAC,\u201d which can consult with Widespread Entry Playing cards, authorities issued id playing cards that grant bodily entry to authorities buildings and safe rooms.<\/p>\n The individuals behind Nexus declare the license pictures are coming from an lively breach at \u201ca significant id verification firm\u201d whose clients embrace a number of Fortune 500 corporations.<\/p>\n The document totals listed by the Nexus id theft service. The variety of drivers license data elevated by practically 400,000 within the span of simply 24 hours.<\/p>\n<\/div>\n \u201cWe’ve been constantly exfiltrating new knowledge for over a 12 months into our non-public database,\u201d the service enthused in its introductory submit on Exploit. \u201cInformation can be found to preview earlier than buy with pertinent info redacted. Buyer photographs are displayed if out there.\u201d<\/p>\n Certainly, over the previous 24 hours, the variety of drivers license data listed as out there in Nexus has elevated by practically 400,000, suggesting that freshly stolen license knowledge is being harvested and uploaded to this service on a semi-regular foundation.<\/p>\n The document that options my drivers license contains six picture information \u2014 three pairs of photographs of the license\u2019s back and front \u2014 a fundamental picture scan \u2014 in addition to infrared and ultraviolet variations of the identical pictures. A date and timestamp is appended to every picture file, and the timestamp on my license scan corresponds to a date in June 2025 once I took a flight to the midwest United States to attend a household funeral.<\/p>\n A number of the 153 million+ license scans \u2014 together with mine \u2014 function six picture information with date and timestamps appended to the filenames. Not all data embrace photographs, and a few that do function photographs don’t show the related filenames.<\/p>\n<\/div>\n Intent on discovering the supply of this knowledge, KrebsOnSecurity requested greater than a dozen family and friends members for permission to seek for their licenses on this service. Every particular person whose license might be discovered (9 of them) confirmed having traveled on or very near the dates within the timestamps hooked up to their pictures. It’s unclear what timezone these timestamps are in, however from reviewing automobile rental data shared by a number of individuals who helped with this analysis, it seems the timezone is about to Greenwich Imply Time (GMT).<\/p>\n At first, I assumed the supply of the information might need one thing to do with airports. Nevertheless, that concept went out the window when it turned obvious there have been no passports on this knowledge set. Additionally, solely a few of those that helped with this analysis stated they confirmed their drivers license on the airport on the day of their journey. One particular person whose license was in Nexus hadn\u2019t flown in any respect lately, however was renting a automobile from Hertz<\/strong> for a number of months across the date of their timestamp.<\/p>\n Two of those that agreed to assist are federal workers who stated they shared different types of authorities identification when passing by means of airport safety. Nevertheless, these people every stated they shared their state-issued drivers licenses later that day when renting automobiles at their respective locations, and that each rented their vehicles from Hertz.<\/p>\n After discovering a notice in my calendar for the day of my June 2025 flight reminding me to carry my passport, I remembered that I additionally by no means really shared my drivers license once I went by means of safety at Reagan Nationwide Airport on that day as a result of I didn’t but have a Actual ID, a security-enhanced drivers license that’s now required by the Transportation Safety Administration (TSA) for all home journey. As an alternative, I confirmed the TSA agent my government-issued U.S. passport.<\/p>\n Right here\u2019s the place it will get attention-grabbing: I used to be capable of finding my mom\u2019s drivers license on this service as effectively, and the timestamps for her pictures are only a few seconds aside from mine. That\u2019s notable as a result of we each handed our licenses to the Hertz rental automobile consultant on the similar time.<\/p>\n In line with my mother, the one place she gave her drivers license to that day was the rental automobile firm, and if reminiscence serves that can be true for me. I don\u2019t recall if the rental automobile consultant inserted our licenses into any type of machine, however I bear in mind they held onto them for a number of minutes behind the counter whereas we have been signing numerous types. KrebsOnSecurity sought remark from Hertz and can replace this story within the occasion they reply.<\/p>\n Zach Edwards<\/strong> is a widely known safety and privateness researcher who lately launched a service referred to as DecryptAds<\/a> to assist individuals higher perceive how on-line advertisers are monitoring them. A scan of Edwards\u2019s drivers license is offered for buy on this id theft service, and Edwards stated the timestamp on his document corresponds to the center of a visit final month to Las Vegas for the annual DEFCON safety convention.<\/p>\n Edwards advised KrebsOnSecurity that though he didn’t lease a automobile in Vegas, he did hand over his license on the TSA checkpoint, at a marijuana dispensary in Vegas, and at his lodge (the Aria). However he stated the one a kind of three that for positive scanned his ID in some type of system was the dispensary.<\/p>\n To enter Planet13\u2019s weed dispensary in Las Vegas, one should move by means of a pink phone sales space. Picture: Zach Edwards.<\/p>\n<\/div>\n Edwards stated the dispensary he visited that day was Planet13<\/strong>, a multi-state chain with shops in California, Florida, Illinois and Nevada. In 2022, the New Orleans-based id supplier idscan.web<\/strong> revealed a press launch<\/a> asserting an unique id verification settlement with Planet13\u2019s dispensaries nationally. IDScan says it processes ID verification for greater than 1,000 marijuana dispensaries in 19 U.S. states.<\/p>\n The \u201cbelief\u201d web page of idscan.web states that the corporate supplies id verification companies for quite a few huge manufacturers, together with Hertz, Goal<\/strong>, Fedex<\/strong>, Motorola Options<\/strong>, the monetary companies large Jack Henry<\/strong>, and Caesars Leisure<\/strong>. And as idscan.web\u2019s personal documentation states<\/a>, the know-how scans IDs with each infrared and ultraviolet gentle. Idscan.web says the corporate\u2019s methods and know-how carry out greater than 21 million verifications month-to-month, at greater than 20,000 areas world wide.<\/p>\n Picture: idscan.web.<\/p>\n<\/div>\n Contacted by KrebsOnSecurity, idscan.web stated it was investigating the matter, however the firm has not but shared an official assertion or a substantive reply to particular questions despatched by way of electronic mail.<\/p>\n \u201cAt this level I\u2019m not capable of share any extra info, however the updates you’ve offered have been welcome, and useful to our staff\u2019s investigation,\u201d wrote Jillian Kossman<\/strong>, a advertising and operations chief at idscan.web.<\/p>\n Through the course of my analysis for this story, phrase apparently bought round to the FBI that I used to be poking on the obvious supply of this new id theft service\u2019s knowledge. Most likely they have been tipped off once I shared with a trusted supply that Nexus is also promoting the drivers license info for the assistant director of the FBI (I didn’t discover FBI Director Kash Patel\u2019s license in Nexus).<\/p>\n Earlier this afternoon, I used to be added to a convention name with a half-dozen FBI brokers, together with senior leaders from the company\u2019s cyber division. Throughout that decision, the FBI shared that earlier at present their New Orleans discipline workplace opened an official investigation into an obvious breach involving idscan.web.<\/p>\n Edwards stated that as extra in-person and on-line experiences require sharing drivers licenses, distributors who gather this delicate knowledge have to be held to a better commonplace.<\/p>\n \u201cThis episode ought to additional strengthen the resolve for people who find themselves preventing again in opposition to on-line ID schemes that are requiring numerous suppliers to ask for drivers licenses to be able to entry companies below the guise of defending youngsters,\u201d Edwards advised KrebsOnSecurity. \u201cThese methods are placing delicate knowledge into an increasing number of third celebration distributors, and we don\u2019t have practically the oversight to make sure they’re protected.\u201d<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/09\/nexus-phegseth.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/09\/nexus-totals.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/09\/nexus-bk.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/09\/planet13.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/09\/idscan-partners.png\")
<\/p>\n