The FBI is probing Nexus, an ID theft service that claimed to sell scans of 153M+ driver's licenses from people in the US and Canada, now gone from the dark web

Krebs on Security 2026-09-03 Brian Krebs

Context & Ripple Effects

Nexus fits a long-running pattern of underground identity-data services: in 2013, SSNDOB was linked to attacks on large data brokers, and in 2022 the FBI and IRS took down the SSNDOB marketplace, which had sold identifying data on about 24 million US people.

The FBI’s Nexus investigation and the service’s disappearance disrupt access to its alleged inventory, but the central claim—more than 153 million US and Canadian driver’s-license scans—remains unconfirmed. Public reaction has focused on the exposure created when businesses scan and retain physical IDs, rather than merely inspect them.

First-order effects

The FBI’s probe puts Nexus and any operators or infrastructure supporting the service under immediate law-enforcement scrutiny.
Nexus being inaccessible removes a sales venue for buyers seeking the driver’s-license scans it claimed to offer, while investigators assess the service’s claims.

Second-order effects

Businesses that collect ID scans for in-person verification face pressure to examine whether retaining those images creates a resale target, a concern raised in public discussion of the case.
The earlier SSNDOB takedown shows that closing a marketplace can interrupt a distribution channel, while not by itself resolving the supply of stolen identity data.

Third-order effects

Repeated markets for consumer identity records point to an identity-verification model in which collecting a full document creates enduring exposure beyond the original transaction.
If enforcement continues to focus on marketplaces as well as data sources, operators handling identity documents will face greater incentives to minimize retention and narrow access to scans.

The trend: Identity-data crime is shifting from isolated credential theft toward marketplaces that package high-value verification documents for reuse across fraud schemes.

Discussion

@vxunderground @vxunderground on x
I really recommending reading this. In summary, a company which does ID verification for in-person interactions (hotels, car rentals, ID verification for alcohol or marijuana, etc) has some how exposed over 153,000,000 drivers licenses for people in the United States and Canada. …
@vxunderground @vxunderground on x
The company which leaked data is IDScan. IDScan does not list all of their customers, however some are publicly known. If you have ever used these companies (and provided an ID) your data has been leaked: - Shell - AMC Theaters - DraftKings - Dutchie - FedEx - Hertz - Chevrolet (…
@recmo Remco on x
153 million peoples private details are for sale on the dark web. That's half of the US! All because one KYC company messed up. This sadly happens regularly. Data harvesting KYC needs to stop NOW. No-one should collect such information. What drove me to build ProveKit is showing …
@dcuthbert Daniel Cuthbert on x
At this point it just seems sensible to just leave stuff unencrypted all over the place as they have access anyway. FML
@spencerhakimian Spencer Hakimian on x
Hahaha you can buy Pete Hegseth for $100
@lukeweston Luke Weston on x
- Stop using SaaS for absolutely bloody everything. - Son of Anton is banned, just check IDs like a normal human being. - There is a huge diff between *checking* ID and scanning, storing and transferring personal ID. - Stop taking and retaining data and calling it “verifying”.
@andreworlowski Andrew Orlowski on x
An insecure digital identity system leaks. The state is building an insecure digital identity system you are forced to use. Don't believe Big Brother Watch when they keep telling you it's been cancelled. It hasn't.
@peterpham Peter Pham on x
153M drivers licenses . Wow what a data breach
@maiab Maia Bittner on x
oh my god this is so bad
@zooko @zooko on x
This part isn't 100% confirmed yet, but apparently the criminals have been stealing all of these driver's licenses (for the last year) from a company that AML/KYC laws and age-verification laws require you to send a copy of your driver's license to. https://x.com/...
@danielsinclair Daniel Sinclair on x
I don't understand why mobile ID verifiers and photography attestation have not more widely proliferated through society. We're still just taking photos of IDs. What are we doing wrong here?
@gustavoturnerx Gustavo Turner on x
The adult industry trade organization, the @FSCArmy, has been warning for years that the age verification methods in legislation advanced by conservative/religious anti-porn politicians were a HUGE security risk (as opposed to device-based age verification). Well guess what:
@daniellefong Danielle Fong on x
cyber security id apocalypse time
@augusteprompt Auguste Prompt on x
no system is going to be secure. all your data is going to be leaked. we better just accept this is the world we live in.
@uk_daniel_card @uk_daniel_card on x
another ID verification data breach... who could have guessed! /S
@zooko @zooko on x
A darkweb service discovered that is selling 150 million people's driver's licences. https://krebsonsecurity.com/ ... Pete Hegseth's driver's license is for sale for $100.
@givnerariel Ariel Givner on x
Godspeed to IDScan's legal team.
@o1dga @o1dga on x
>Another ID verification company is experiencing another major data breach, exposing a ton of sensitive information they claimed they were not storing.
@grayzoneintel Mike Shelby on x
This is nuts. 153 million drivers licenses and ID cards. Targeting gold mine ☠️
@vxunderground @vxunderground on x
Dawg, they got Pete Hegseth in the data breach. It's available for sale for $100
@campuscodi.risky.biz Catalin Cimpanu on bluesky
Per the most recent update, the service has gone offline [embedded post]
@michaelsderby Michael Derby on bluesky
New monster security breach as potentially 153 million drivers licences appear to have been hacked.
@ladyinsanity Ashe on bluesky
To add: 153+ MILLION U.S. driver licenses were recently leaked on the dark web. From your neighbor to the literal Defense Sec. — It is reckless to think any of these ID verification services are secure. Any of them. krebsonsecurity.com/2026/09/fbi- ... [embedded post]
@sky.skymarchini.net Sky Marchini on bluesky
oh good! (also it's incredibly funny they used pete hegseth as the example) krebsonsecurity.com/2026/09/fbi- ...
@daphnek Daphne Keller on bluesky
But don't worry, every platform that has to do age verification will do it in a really robust, privacy-protective way. [embedded post]
@metacurity.com Cynthia Brumfield on bluesky
Super scary - an identity theft service called Nexus is offering digital scans of identity documents for more than 170 million people in North America, including scans at airports and cannabis dispensaries. — Krebs says the details check out. — krebsonsecurity.com/2026/09/fbi…
@hatr Hakan on bluesky
“The source brought it to my attention because the proprietor of this identity theft service offered my Virginia drivers license as a free sample in their initial sales thread on Exploit.” — krebsonsecurity.com/2026/09/fbi- ...
@esqueer.net Alejandra Caraballo on bluesky
This is an absolutely catastrophic data breach of an identity verification vendor 150+ million drivers license scans that includes photos, address, license numbers etc. — It includes Pete Hegseth, security researchers, and even the deputy director of the FBI. — krebsonsecurit…
@ncweaver.skerry-tech.com Nicholas Weaver on bluesky
Big news from Brian Krebs: — krebsonsecurity.com/2026/09/fbi- ... Massive identity breach of 150M+ drivers license scans.
@joeuchill Joe Uchill on bluesky
Looks like IDScan might have been popped. — If you've used an ID for a commercial service (renting a car, going to a dispensary, etc), might want to look into this.
@lizthegrey.com Liz Fong-Jones on bluesky
This is why you shouldn't trust a service that claims to “delete scans of your ID” once they're verified. a provider to Hertz and many other US companies just got popped. krebsonsecurity.com/2026/09/fbi- ...
r/news r on reddit
FBI Probes Service Selling 153M+ Drivers Licenses - Krebs on Security
r/onguardforthee r on reddit
1.1 million Canadian driver licences found in hack of digital ID verification service
r/technology r on reddit
FBI Probes Service Selling 153M+ Drivers Licenses
r/privacy r on reddit
FBI Probes Service Selling 153M+ Drivers Licenses

Chronicles