FBI Probes ID Verification Vendor After 153M Driver's Licenses Leak Online

A new dark web service called Nexus is peddling digital scans of more than 153 million driver's licenses from the U.S. and Canada, and the FBI has opened an investigation into the apparent source: Louisiana-based identity verification company idscan.net.

KrebsOnSecurity reports that Nexus, advertised on the Russian cybercrime forum Exploit, offers records with multiple image files per license, including infrared and ultraviolet scans. The timestamps on these images align with dates when individuals interacted with specific businesses—most notably Hertz rental car counters and a Las Vegas marijuana dispensary.

Researcher Zach Edwards found his license timestamp matched a visit to Planet13, a dispensary that partnered with idscan.net in 2022. The company's own documentation confirms it scans IDs with infrared and UV light, and its client list includes Hertz, Target, FedEx, and Caesars Entertainment.

KrebsOnSecurity's investigation suggests the data is being continuously exfiltrated, with nearly 400,000 new records added in just 24 hours. The FBI's New Orleans field office has launched an official inquiry into the breach.

This incident underscores the risks of ubiquitous ID scanning at rental counters, dispensaries, and other venues. As Edwards noted, these systems push sensitive data into third-party vendors with insufficient oversight.