The FBI is investigating Nexus, a new ID theft service on the dark web claiming to sell digital scans of 153M+ drivers licenses from people in the US and Canada

A new identity theft service launched on the dark web this week is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada.Forums:Hacker Newsandr/newsForums:Hacker News:FBI Probes Service Selling 153M+ Drivers Licensesr/news:FBI Probes Service Selling 153M+ Drivers Licenses

Krebs on Security 2026-09-02 Brian Krebs

Context & Ripple Effects

The prior record traces a durable underground identity-data trade: a 2013 account documented price cuts driven by an oversupply of stolen identities, while the FBI and IRS helped dismantle the SSNDOB identity-data marketplace in 2022. Nexus puts the FBI back on the enforcement side of that cycle, but its claimed inventory of more than 153 million license scans remains unconfirmed.

The important distinction is the alleged product format. Names and account attributes enable impersonation; document scans can also be presented in workflows that treat a driver’s license image as evidence of identity. Public reaction focused on the possibility that an ID-verification provider retained data, but that attribution is not established in the supplied record.

First-order effects

The FBI investigation raises immediate legal and operational pressure on Nexus and may disrupt a newly launched marketplace for purported license scans.
Organizations using driver’s-license images in identity checks face a more acute fraud-control problem if authentic-looking scans are broadly available through Nexus.

Second-order effects

Identity-verification providers have incentive to place less weight on a document image alone and more on checks tied to the person presenting it, such as liveness or possession signals.
Law-enforcement action against Nexus follows the earlier SSNDOB marketplace takedown, reinforcing a pattern in which marketplace operators—not only the sources of compromised data—become enforcement targets.

Third-order effects

If document-scan inventories remain available across criminal markets, a static government ID image becomes a weaker standalone credential, shifting digital onboarding toward layered [[a:proof of personhood|proof-of-personhood]] systems.
The recurring supply-and-takedown cycle points to identity fraud as a market-structure problem: enforcement can remove individual venues while valuable reusable identity data continues to circulate.

The trend: Digital identity systems are moving away from trust in a submitted document image and toward verification that the claimant is a live, present person.

Discussion

r/news r on reddit
FBI Probes Service Selling 153M+ Drivers Licenses
@grayzoneintel Mike Shelby on x
This is nuts. 153 million drivers licenses and ID cards. Targeting gold mine ☠️
@o1dga @o1dga on x
>Another ID verification company is experiencing another major data breach, exposing a ton of sensitive information they claimed they were not storing.
@givnerariel Ariel Givner on x
Godspeed to IDScan's legal team.
@daniellefong Danielle Fong on x
cyber security id apocalypse time
@uk_daniel_card @uk_daniel_card on x
another ID verification data breach... who could have guessed! /S
@maiab Maia Bittner on x
oh my god this is so bad
@vxunderground @vxunderground on x
The company which leaked data is IDScan. IDScan does not list all of their customers, however some are publicly known. If you have ever used these companies (and provided an ID) your data has been leaked: - Shell - AMC Theaters - DraftKings - Dutchie - FedEx - Hertz - Chevrolet (…
@zooko @zooko on x
A darkweb service discovered that is selling 150 million people's driver's licences. https://krebsonsecurity.com/ ... Pete Hegseth's driver's license is for sale for $100.
@zooko @zooko on x
This part isn't 100% confirmed yet, but apparently the criminals have been stealing all of these driver's licenses (for the last year) from a company that AML/KYC laws and age-verification laws require you to send a copy of your driver's license to. https://x.com/...
@vxunderground @vxunderground on x
I really recommending reading this. In summary, a company which does ID verification for in-person interactions (hotels, car rentals, ID verification for alcohol or marijuana, etc) has some how exposed over 153,000,000 drivers licenses for people in the United States and Canada. …
@spencerhakimian Spencer Hakimian on x
Hahaha you can buy Pete Hegseth for $100
@gustavoturnerx Gustavo Turner on x
The adult industry trade organization, the @FSCArmy, has been warning for years that the age verification methods in legislation advanced by conservative/religious anti-porn politicians were a HUGE security risk (as opposed to device-based age verification). Well guess what:
@vxunderground @vxunderground on x
Dawg, they got Pete Hegseth in the data breach. It's available for sale for $100
@andreworlowski Andrew Orlowski on x
An insecure digital identity system leaks. The state is building an insecure digital identity system you are forced to use. Don't believe Big Brother Watch when they keep telling you it's been cancelled. It hasn't.
@joeuchill Joe Uchill on bluesky
Looks like IDScan might have been popped. — If you've used an ID for a commercial service (renting a car, going to a dispensary, etc), might want to look into this.
@ncweaver.skerry-tech.com Nicholas Weaver on bluesky
Big news from Brian Krebs: — krebsonsecurity.com/2026/09/fbi- ... Massive identity breach of 150M+ drivers license scans.
@esqueer.net Alejandra Caraballo on bluesky
This is an absolutely catastrophic data breach of an identity verification vendor 150+ million drivers license scans that includes photos, address, license numbers etc. — It includes Pete Hegseth, security researchers, and even the deputy director of the FBI. — krebsonsecurit…
@lizthegrey.com Liz Fong-Jones on bluesky
This is why you shouldn't trust a service that claims to “delete scans of your ID” once they're verified. a provider to Hertz and many other US companies just got popped. krebsonsecurity.com/2026/09/fbi- ...
@dcuthbert Daniel Cuthbert on x
At this point it just seems sensible to just leave stuff unencrypted all over the place as they have access anyway. FML
@augusteprompt Auguste Prompt on x
no system is going to be secure. all your data is going to be leaked. we better just accept this is the world we live in.
@danielsinclair Daniel Sinclair on x
I don't understand why mobile ID verifiers and photography attestation have not more widely proliferated through society. We're still just taking photos of IDs. What are we doing wrong here?
@peterpham Peter Pham on x
153M drivers licenses . Wow what a data breach
@lukeweston Luke Weston on x
- Stop using SaaS for absolutely bloody everything. - Son of Anton is banned, just check IDs like a normal human being. - There is a huge diff between *checking* ID and scanning, storing and transferring personal ID. - Stop taking and retaining data and calling it “verifying”.
r/privacy r on reddit
FBI Probes Service Selling 153M+ Drivers Licenses
@metacurity.com Cynthia Brumfield on bluesky
Super scary - an identity theft service called Nexus is offering digital scans of identity documents for more than 170 million people in North America, including scans at airports and cannabis dispensaries. — Krebs says the details check out. — krebsonsecurity.com/2026/09/fbi…
@hatr Hakan on bluesky
“The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit.” — krebsonsecurity.com/2026/09/fbi- ...
r/news r on reddit
FBI Probes Service Selling 153M+ Drivers Licenses
r/onguardforthee r on reddit
1.1 million Canadian driver licences found in hack of digital ID verification service
r/news r on reddit
FBI Probes Service Selling 153M+ Drivers Licenses - Krebs on Security
@recmo Remco on x
153 million peoples private details are for sale on the dark web. That's half of the US! All because one KYC company messed up. This sadly happens regularly. Data harvesting KYC needs to stop NOW. No-one should collect such information. What drove me to build ProveKit is showing …
@michaelsderby Michael Derby on bluesky
New monster security breach as potentially 153 million drivers licences appear to have been hacked.
r/technology r on reddit
FBI Probes Service Selling 153M+ Drivers Licenses

Chronicles