FBI Launches Investigation into Massive Driver License Data Leak
The New Orleans field office of the Federal Bureau of Investigation has opened an official inquiry into the source of over 153 million driver license scans being sold on a dark web identity theft service dubbed Nexus. The investigation follows KrebsOnSecurity’s reporting that the service launched this week offering digital scans of identity documents from individuals across the United States and Canada, including high-profile figures such as U.S. Defense Secretary Pete Hegseth.
Nexus Service Offers Access to Hundreds of Millions of Identity Records
Nexus claims to possess more than 153 million driver licenses, over 10 million identification cards, more than three million travel documents or international IDs, and at least 579,000 medical cards. A blank search on the platform returns approximately 11.5 million pages of results, with roughly 15 records per page, lending credibility to the scale of the dataset. While records include individuals from both the U.S. and Canada, the vast majority are American, with Ontario accounting for the largest share of Canadian licenses at approximately 473,673 records.
Timestamps and Image Formats Suggest Systematic Data Harvesting
Each driver license record in Nexus often includes multiple image files — front and back scans, basic scans, and infrared and ultraviolet versions — each with embedded timestamps. One reporter’s own license scan contained a timestamp matching a June 2025 flight to the Midwest for a family funeral. Similar patterns emerged when friends and family members verified their own records: the timestamps aligned closely with recent travel or car rental activity.
Notably, the reporter and their mother obtained Hertz rental car vehicles at the same time and location, and their license timestamps were separated by only a few seconds. Neither recalled presenting their licenses at airport security that day due to lacking Real ID compliance, instead using passports for TSA screening.
Link to IDScan.net Emerges Through Corporate Partnerships
Nexus operators claim the data originates from an ongoing breach at "a major identity verification company." Investigative reporting points to IDScan.net, a Louisiana-based firm headquartered in New Orleans, which provides identity verification services to numerous Fortune 500 companies. IDScan.net’s own documentation confirms its systems scan IDs using infrared and ultraviolet light — matching the image types found in the Nexus dataset.
The company processes over 21 million verifications monthly across more than 20,000 global locations. Its client list includes Hertz, Target, FedEx, Motorola Solutions, Jack Henry, and Caesars Entertainment. Notably, IDScan.net announced in 2022 an exclusive verification agreement with Planet13, a multi-state marijuana dispensary chain, which became relevant when researcher Zach Edwards confirmed his license was scanned at a Planet13 location in Las Vegas during a DEFCON trip.
Independent Verification Confirms Data Freshness and Source
Over a 24-hour period, the number of driver license records in Nexus increased by nearly 400,000, indicating active and ongoing data exfiltration. The service’s introductory post on the Russian cybercrime forum Exploit stated: "We have been continuously exfiltrating new data for over a year into our private database."
KrebsOnSecurity conducted independent verification by asking over a dozen contacts to check for their licenses in Nexus. Nine individuals confirmed their records were present, and each acknowledged that the timestamps on their scans corresponded to recent instances where they had presented their driver licenses — primarily during car rentals at Hertz locations or, in some cases, at marijuana dispensaries.
FBI Confirms Investigation, IDScan.net Acknowledges Unauthorized Access
After being alerted by KrebsOnSecurity’s research, the FBI invited the reporter to a conference call with multiple agents, including senior cyber division leaders. During the call, officials confirmed that the New Orleans field office had opened an official investigation into a potential breach involving IDScan.net.
On September 2, IDScan.net issued a brief statement acknowledging that "an unauthorized third party may have accessed and/or copied certain customer information, including full names and driver license or other government-issued identification numbers." The company said it was notifying affected individuals and offering credit protection services. A follow-up update on September 8 reiterated the ongoing investigation.
Privacy and Security Experts Warn of Broader Implications
Security researchers warn that the exposure of driver licenses poses significant risks, particularly for vulnerable populations. Larry Baldwin, principal intelligence researcher at Cybera, noted that state-issued licenses are frequently used to open lines of credit and that the breach could endanger individuals who cannot alter their appearance — such as those fleeing domestic violence or participants in witness protection programs.
Zach Edwards, creator of DecryptAds, emphasized that as more services require driver license verification, vendors handling this data must be held to higher accountability standards. He warned that the proliferation of third-party identity verification systems increases exposure risk without sufficient oversight.
As of the latest update, IDScan.net continues to investigate the incident, and the FBI’s probe remains active. KrebsOnSecurity has sought comment from Hertz regarding its potential role in the data collection chain and will update the story if a response is received.
Source: Krebs on Security