FBI investigates theft of 153 million driver's licenses from US and Canada

The FBI is investigating the potential theft and dark web sale of over 153 million driver's licenses from the US and Canada. Discovered by cybersecurity journalist Brian Krebs on a service called Nexus, the digital scans are linked to Louisiana-based ID-verification firm IDScan.net, which serves major clients like Hertz and Target. Security experts warn that the exposure of physical ID scans, including infrared and ultraviolet images, significantly increases the risk of sophisticated identity fraud.

Nexus dark web data breach

• ▪The Nexus database reportedly contained over 10 million identification cards, over 3 million travel documents, and at least 579,000 medical cards.
• ▪A dark web service named Nexus advertised digital scans of more than 153 million driver's licenses belonging to people in the United States and Canada.
• ▪The Nexus website disappeared from the dark web shortly after cybersecurity journalist Brian Krebs published his report on September 2, 2026.
• ▪The Nexus service was advertised on the Russian cybercrime forum Exploit on August 31, 2026, claiming to hold identity documents for over 170 million people.

IDScan.net as suspected source

• ▪Timestamps on several leaked licenses on Nexus matched dates when individuals rented vehicles from Hertz or visited Planet13, both of which use IDScan.net.
• ▪IDScan.net marketing and operations leader Jillian Kossman confirmed the company was investigating the matter but could not share additional details.
• ▪Cybersecurity journalist Brian Krebs identified Louisiana-based identity verification provider IDScan.net as the potential source of the leaked driver's license scans.

FBI investigation

• ▪The FBI opened its investigation after learning that Nexus was selling the driver's license information of an FBI assistant director.
• ▪The FBI's New Orleans field office opened an official investigation into an apparent data breach involving IDScan.net.
• ▪The FBI confirmed in an official statement that it was looking into the incident but declined to comment further due to the ongoing investigation.

Identity theft risks

• ▪Privacy researcher Zach Edwards warned that widespread requirements to submit driver's licenses create large pools of sensitive data at third-party companies without sufficient oversight.
• ▪Cybera researcher Larry Baldwin stated that compromised driver's license scans put vulnerable individuals, such as domestic violence survivors, at risk.
• ▪Identity Theft Resource Center president James E. Lee warned that stolen digital scans containing photographs make it easier for fraudsters to create fake credentials.

Driver's license scans stolen

• ▪The stolen data includes digital scans of both sides of driver's licenses, with some records containing infrared and ultraviolet scans.
• ▪The stolen database contains records from both the US and Canada, with Canadian driver's licenses accounting for approximately 1.1 million results.

Debatable claims

• ▪Driver's licenses should not be used for digital identity verification
• ▪Governments should ban private companies from storing digital scans of customer IDs

4 sources