Dark Web Marketplace Exposes 153 Million Driver's Licenses in Massive Breach

A dark web platform known as Nexus has begun selling a trove of digital identity documents, including scans of more than 153 million driver's licenses across the United States and Canada. The breach, originally uncovered by cybersecurity researcher Brian Krebs, includes sensitive personal details belonging to everyday citizens and high-profile figures, including U.S. Defense Secretary Pete Hegseth.

Scope of the Stolen Data

The seller on the Russian-language forum Exploit claimed to have continuously exfiltrated data from a private database over the course of a year. The full dataset offered on the marketplace includes:

  • 153 Million+ Driver's Licenses: Includes standard driver's licenses, commercial licenses, and full scans.
  • 10 Million+ ID Cards: Personal identification records from multiple jurisdictions.
  • 3 Million Travel Documents: International travel cards and passport scans.
  • 579,000 Medical Cards: Sensitive health identification documents.

Many of the listings included front and back scans, accompanied by specialized infrared and ultraviolet light versions captured during physical ID verification checks. Users on the platform could search and "unlock" complete records for $100.

Link to IDScan.net and FBI Investigation

Krebs traced the stolen document formats to IDScan.net, an AI-powered verification platform processing roughly 21 million IDs per month for prominent clients like FedEx, Hertz, Target, GameStop, and various marijuana dispensaries. Following the exposure, the FBI's New Orleans field office initiated an official investigation into the breach.

While Nexus briefly went offline with a message stating the service was unavailable, experts warn that the underlying data remains compromised.

Growing Risks of Mandatory Online ID Checks

Security researchers warn that identity thefts involving full document scans pose far greater risks than leaked passwords. Scanned IDs contain names, birth dates, physical addresses, and photos that enable sophisticated identity fraud, non-consensual tracking, and social-engineering attacks.

With modern legislation increasingly requiring age-verification checks for online access, experts warn that centralizing photo ID collection across third-party platforms creates broader targets for cybercriminals globally.