A dark web identity theft service called Nexus began selling digital scans of more than 153 million US and Canadian driver's licenses in the week of August 31, 2026, most of them American. The FBI's New Orleans field office opened an investigation on September 1, and the site went dark hours later.
Investigative journalist Brian Krebs found his own license listed, then asked more than a dozen friends and family for permission to search. All nine he found confirmed traveling on or near the timestamps attached to their images. The common thread was Hertz car rentals, plus a Las Vegas dispensary in one case.
Both point to IDScan.net, a Louisiana identity verification firm that lists Hertz as a client and holds an exclusive agreement with that dispensary chain. IDScan scans IDs with infrared and ultraviolet light, and the Nexus records include infrared and ultraviolet versions of each license.
IDScan.net says it is investigating and has issued no statement. Nexus operators claim a year of continuous exfiltration, and the license count grew by nearly 400,000 in a single day. Licenses for Defense Secretary Pete Hegseth and the FBI's assistant director were among those listed.
NCC Group's Tim Rawlins says organizations should design identity systems assuming that identity evidence will eventually be compromised, and should hold identity vendors to contract terms covering retention, incident notification, and independent assurance.
Source: SecurityWeek