FBI opens inquiry as dark web service lists scans of 153 million driver's licences
An identity-verification vendor appears to be the source, a reminder that document images become a liability the moment they are retained.
A new identity-theft service on the dark web, operating under the name Nexus, this week began offering digital scans of more than 153 million driver's licences belonging to people in the United States and Canada, along with millions of other identity documents, according to a report published on 1 September by KrebsOnSecurity. The FBI's New Orleans field office opened an official inquiry into the source of the images the same day, and Krebs reported that senior officials in the bureau's cyber division briefed him on the inquiry.
The report says the evidence points to IDScan.net, a widely used identity-verification company based in Louisiana whose customers include Hertz, Target, FedEx and a large number of cannabis dispensaries. Each record on the marketplace reportedly contained six image files per licence, including front, back, infrared and ultraviolet captures, each stamped with a GMT timestamp.
Those timestamps were the key to tracing the data. Security researcher Zach Edwards found that the timestamp on his own licence matched a visit to a Las Vegas dispensary that uses IDScan.net's service. Brian Krebs reported that his licence and his mother's both appeared in the listings with timestamps matching a Hertz car rental the two made on the same day in June 2025.
IDScan.net initially said it was investigating but could not share further information. In an update, the company confirmed that there had been unauthorised access to customer data. Within hours of the article being published, the Nexus service disappeared from the dark web, replaced by a notice stating that it was no longer available.
Why it matters
Identity-verification vendors sit in the middle of thousands of ordinary transactions, and each one leaves behind a high-resolution copy of a government document. Concentrating those copies in one place creates a target far more valuable than any single retailer's customer list. The incident shows how third-party data handling can expose people who have never heard of the company involved. As more services move identity checks online, the question of how long scanned documents are kept, and by whom, becomes central to consumer security.
Identity-verification vendors sit in the middle of thousands of ordinary transactions, and each one leaves behind a high-resolution copy of a government document.
Customer hands over licence
A rental desk or dispensary scans the card to verify age or identity.
Vendor captures multiple images
Front, back, infrared and ultraviolet captures reveal security features.
Images are retained with timestamps
Each record keeps the capture time, which later ties it to a place and date.
Unauthorised access to the store
The vendor confirmed unauthorised access to customer data.
Documents offered for sale
A marketplace lists the scans; timestamps let victims trace the source.
What you can learn from this
Verification pipelines create archives whether or not anyone intends them to. An ID scanner captures multiple images under visible, infrared and ultraviolet light because security features on a licence are only visible under specific wavelengths. That is good for spotting a fake, but if those images are retained after the check completes, the vendor now holds a document set that is more complete than the original card. The principle of data minimisation says a system should keep only what it needs, for only as long as the purpose requires. Retention limits also shrink the window in which a breach can do damage.
Third-party risk means you can be breached by a company you have never met. The people whose licences appeared for sale handed their cards to a rental desk or a dispensary, not to a verification vendor. Modern services are built from chains of suppliers, and each link inherits the data of the one before it. Security teams model this as supply-chain or fourth-party risk, and it is why vendor assessments ask not just "what do you collect" but "who else sees it." A vendor two steps removed from the customer still has to be secured to the same standard as the front door.
Metadata is evidence, and timestamps are the sharpest kind. The researchers linked the leaked images to a source by matching capture times against their own movements. This is timeline correlation, a standard forensic technique: two independent records that agree on a moment in time strongly suggest a shared origin. It also cuts both ways, since the same metadata that helps investigators tells a buyer exactly where and when a victim was. Investigators use the same method to attribute leaked data to a specific breach when several candidates exist.
Documents cannot be rotated the way passwords can. A leaked password is fixed by changing it. A leaked licence scan, complete with number, address, photograph and security-feature captures, remains valid until the document expires and is reissued. That durability is what makes document images useful for opening accounts, passing remote identity checks or building synthetic identities long after the original breach has been forgotten. Replacing a licence in response to a leak is possible in some jurisdictions but slow and rarely automatic.
A marketplace going offline does not mean the data is gone. Nexus vanished within hours of the report, but sellers typically hold their inventory elsewhere and reopen under a new name when attention fades. Defenders treat takedowns as disruptions rather than resolutions, and assume that any data seen for sale once will resurface, possibly bundled with other breaches.
We teach this
How to use this in practice
Audit where your own application stores uploaded documents. If you run any service that accepts image uploads of IDs, receipts or forms, list every bucket, table and log where those files or their paths land, and write down the retention period for each. Include backups and error logs, which often keep copies long after the primary store has been cleaned. Done looks like a one-page inventory and a scheduled job that deletes files past their retention date, verified by running it against a test bucket.
Freeze your own credit files. If you live in the United States or Canada, request a credit freeze with each major bureau, which prevents new accounts being opened in your name until you lift it. A freeze can be lifted temporarily when you apply for credit yourself, so it costs little in convenience, and it is worth doing the same for a family member who may not do it themselves. Done looks like a confirmation from each bureau saved in a password manager, plus a note of the PIN or account needed to unfreeze.
Draw the data flow of a single identity check. Sketch the path from the card being scanned, through the retailer's terminal, to the verification vendor's servers, and mark every point where an image could be written to disk. Then mark which of those points are outside your organisation's control, because those are where a vendor contract is your only lever. Done looks like a diagram with each storage point labelled with who controls it and how long data sits there.
Practise timeline correlation on your own logs. Export a week of authentication logs from a service you administer, pick three events, and try to match each to an independent record such as a calendar entry or a badge swipe. This is the same reasoning the researchers used to trace the licence images, applied to data you control. Done looks like a short write-up of which matches were conclusive, which were ambiguous, and what extra field would have removed the ambiguity; keep it, because it becomes a template for incident investigations.
Sources
- FBI Probes Service Selling 153M+ Drivers Licenses — Krebs on Security
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report