Nexus Sold 153M Licenses [2026]

Elias Virtanen
September 5, 2026
14 min read

A dark-web marketplace called Nexus spent late August advertising something cybercrime forums rarely traffic in at this scale: not passwords, not credit card numbers, but forensic-grade scans of the physical identity documents that get you a hotel room, a rental car, or a legal cannabis purchase. By the time Brian Krebs of KrebsOnSecurity finished tracing the operation this week, the count stood at more than 153 million U.S. and Canadian driver’s licenses, and the trail led to a Louisiana-based identity verification vendor called IDScan.net. The FBI’s New Orleans field office confirmed Wednesday it had opened a formal investigation. Then came the detail that pushed the story past a routine vendor breach: among the records was the driver’s license of Defense Secretary Pete Hegseth, according to reporting from International Business Times.

This is not simply a story about another company getting hacked. It’s a story about what happens when the infrastructure built to stop identity fraud becomes the single point of failure that enables it at a continental scale. Here’s what’s confirmed, what remains unverified, and what it means for the identity verification industry that dozens of household-name brands now depend on.

Don’t miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

What the Nexus Marketplace Actually Claimed to Sell

Nexus didn’t operate like a typical dark-web data dump. Sellers on the Russian-language forum Exploit promoted it as an indexed, searchable query engine rather than a static file dump, letting buyers look up individuals by name, jurisdiction, or date of birth before purchasing a full document set. According to the reporting that first surfaced the operation, a blank search across the index returned over 11.5 million result pages, a figure investigators say is broadly consistent with the marketplace’s own claims about scale.

The headline number is the 153 million-plus driver’s licenses from the United States and Canada, with Ontario cited as a heavily represented province. But the licenses were only part of the haul. Nexus also indexed general identification cards, international travel documents, and medical records tied to state-regulated cannabis programs. The table below breaks down what was reportedly listed for sale.

What makes this different from a typical breach of usernames and hashed passwords is the format. The listings reportedly included not just a single photograph but multiple capture types per document: visible-light images, infrared scans, and ultraviolet exposures, the same multi-spectrum imaging techniques that scanning hardware at rental counters and dispensary front desks uses to detect counterfeit holograms and microprinting. Whoever assembled this dataset didn’t just steal identity data. They stole the exact evidence anti-fraud systems rely on to prove a document is genuine.

How Brian Krebs Traced the Leak Back to IDScan.net

Krebs said he was alerted to Nexus after its operators posted his own Virginia driver’s license as a free sample to establish the service’s credibility, a common but risky flex among data brokers trying to prove a database is real. Krebs pulled the thread, and according to IBTimes’s account of his findings, he cross-referenced the database against friends and family members who consented to a search, confirming their records were present. He also worked with independent security and privacy researcher Zach Edwards, who found his own data in Nexus despite not having recently rented a car, tracing it instead to an ID scan submitted at a Planet 13 marijuana dispensary.

The common thread across confirmed victims, per that reporting, was a rental-car transaction through Hertz or an ID check at a cannabis dispensary, with timestamps on the scanned images lining up with the times those individuals had physically presented their licenses. That pattern pointed away from a government DMV breach and toward a shared vendor sitting behind both business types: IDScan.net.

Inside IDScan.net, the Vendor at the Center of the Breach

IDScan.net is described across multiple accounts of the breach as a New Orleans-area identity verification provider that supplies document-scanning hardware and software to businesses that are legally required to check a customer’s government-issued ID, including car rental counters, hotel front desks, and licensed cannabis retailers. A detailed breakdown of the incident published by <a href="https://bytetechlab.com/blog/2026/cybersecurity/massive-identity-verification-breach-exposes-over-150-million-driver-s-licenses-on-the-dark-web/” rel=”nofollow noopener” target=”_blank”>ByteTech Lab reported that IDScan.net’s platform processes upward of 21 million identity verifications per month across more than 20,000 retail, hospitality, and corporate locations, with an enterprise client roster said to include Hertz, FedEx, Target, Caesars Entertainment, and Motorola Solutions.

None of those companies has been confirmed as a direct source of the leaked data, and IDScan.net has not published an official statement establishing the scope or root cause of any compromise. What’s notable is the business model itself: dozens, potentially thousands, of separate retail brands outsourced their ID-verification compliance obligations to a single intermediary. If that intermediary is compromised, every downstream business that trusted it in good faith inherits the exposure, regardless of how tight their own internal security controls are.

The Pete Hegseth Detail That Changes the Story

Every mass identity breach raises the same practical fears: fraud, impersonation, stalking risk. This one has an added dimension. According to IBTimes, the personal identification records of Defense Secretary Pete Hegseth were found among the data cataloged in the Nexus database. That detail matters less for what it says about Hegseth specifically and more for what it says about the pipeline itself: a sitting cabinet official with access to classified information and facilities appears to have gone through the exact same consumer-facing ID submission process as anyone renting a car or visiting a dispensary, and his data ended up exposed the same way.

The Department of Defense did not respond to requests for comment on the matter, per that same report, and it remains unknown whether Hegseth’s data entered the IDScan.net pipeline through the Hertz or dispensary channel most strongly associated with the leak, or through a different client integration entirely. The breach does not appear to have specifically targeted him. That’s arguably the more unsettling part: senior national security officials are consumers of the same commercial identity-verification infrastructure as the general public, and they are exposed to the same failure modes when that infrastructure breaks.

FBI’s New Orleans Field Office Opens a Formal Inquiry

The FBI’s New Orleans field office, the bureau’s primary cyber investigations hub for the Gulf Coast region, confirmed Wednesday that it had opened an investigation into the dark-web service. In a brief statement reported by IBTimes, the FBI said it was “looking into the incident” but declined to comment further, citing “the ongoing nature of the investigation.” The bureau did not confirm or dispute the 153-million-record scale as described by Krebs, and it has not yet released guidance for individuals who believe their documents may be included.

SecurityWeek’s coverage of the incident separately noted that some of the exfiltrated licenses appeared to belong to FBI agents themselves, adding an additional layer of urgency to the bureau’s response beyond the consumer-privacy angle.

IDScan.net’s Response So Far: Forensics, Counsel, and Limited Disclosure

IDScan.net’s public posture has been narrow. Per IBTimes, the company told Krebs it was “investigating the matter” and that the information he supplied had been “welcome, and helpful” to its internal team. CSO Online reported that, as of its publication, IDScan.net had not issued an official statement, though a company leader indicated the firm’s investigation was benefiting from information shared by outside researchers. BleepingComputer’s reporting added that the company had not publicly confirmed a breach and had not responded to its request for comment, but separately said IDScan.net indicated it had initiated an incident-response process, engaged outside counsel and forensic investigators, and was coordinating with law enforcement.

Taken together, that’s a company acknowledging something is being actively investigated without confirming what happened, how it happened, or how many of its customers’ end users are affected. For the businesses that contract with IDScan.net to satisfy their own compliance obligations, that ambiguity is its own operational problem.

Why a Stolen Driver’s License Scan Is Worse Than a Stolen Password

Conventional breach remediation is built around the idea that compromised credentials can be replaced. A leaked password gets rotated. A stolen credit card number gets canceled and reissued, often within minutes, with the cardholder bearing zero permanent loss. A driver’s license number tied to high-resolution photographs of a person’s face, full legal name, date of birth, and home address doesn’t have an equivalent reset button. The document itself can eventually be reissued by a state DMV, but the imagery, the biometric likeness, and the address history that leaked alongside it cannot be un-leaked.

That matters most for the automated systems that increasingly gate access to financial services. Opening a bank account, applying for a loan, or passing a remote know-your-customer (KYC) check online typically asks an applicant to submit a clear photograph of a government ID alongside a selfie. When the exact laboratory-grade optical, infrared, and UV captures used to validate that a document is authentic are already sitting in a criminal marketplace, the fraud-prevention logic those systems depend on stops working as intended. A convincing synthetic identity becomes easier to assemble, not harder.

The Quiet Risk for Protected Populations

There’s a narrower but more severe risk buried in this kind of leak: driver’s licenses display current home addresses. For domestic violence survivors who relocated under a protective order, for judges and law enforcement officers with legally sealed addresses, and for people enrolled in witness protection, a searchable database of current government-issued ID scans is not an abstract privacy concern. It’s a potential map to where they live. Reporting on the breach has not identified specific victims in these categories, but the structural risk is one that privacy researchers have flagged repeatedly whenever centralized identity-document repositories are compromised.

A Database That Kept Growing

Krebs reportedly observed the index still expanding in real time as he reviewed it, which is its own signal about how the underlying pipeline worked. A static leak from a one-time server misconfiguration doesn’t typically add new records by the hundreds of thousands per day. Continuous growth points toward ongoing, active exfiltration from a live system rather than a single historical snapshot being resold.

Timeline: From a Forum Post to a Federal Investigation

Krebs reportedly observed the database still growing during his review, with roughly 400,000 additional records added in a 24-hour window before the site disappeared, according to IBTimes. Security researchers who track dark-web marketplace takedowns caution that a service going dark after public exposure is a common pattern among operators anticipating law enforcement attention, and it does not mean the underlying data has stopped circulating. Once documents of this kind are copied and sold, they rarely disappear from criminal channels entirely.

Competitive Comparison: Centralized ID Vaults vs. Mobile Driver’s Licenses

The IDScan.net incident is landing at a moment when the identity-verification industry is already split between two architectures. The dominant model today, the one implicated in this breach, is the centralized document vault: a business scans a physical ID, the image is stored (sometimes indefinitely) on a vendor’s servers, and a human or algorithm reviews it later if there’s a dispute. The alternative gaining regulatory and technical momentum is the mobile driver’s license, or mDL, an ISO-standard cryptographic credential that a phone can present to a scanner without ever transmitting the underlying document image.

Under an mDL-style handshake, a business scanner can confirm that a customer holds a valid, unexpired, government-issued credential, or that they’re over 21, without the merchant’s systems ever storing a copy of the license itself. There is no centralized image archive for an attacker to steal, because none is created in the first place. Vendors like IDScan.net built their business on the older model precisely because it works with existing point-of-sale hardware at rental counters and dispensaries today, while mDL adoption still depends on both state DMV issuance and merchant-side scanner upgrades that are rolling out unevenly across the US and Canada.

Historical Context: How This Stacks Up Against Past Identity Breaches

Mass exposure of government-issued identity data isn’t new, but the format here is unusual. The 2017 Equifax breach, widely reported at the time as affecting roughly 147 million Americans, exposed Social Security numbers and other personal data but not, in most cases, actual document images. The 2024 breach tied to background-check aggregator National Public Data was reported to involve billions of records across name, address, and Social Security number combinations, again largely text-based data rather than scanned documents. AT&T’s 2024 disclosures affected tens of millions of customer accounts through call records and account data.

What sets the Nexus/IDScan.net episode apart, if the reporting holds up, is that the exposed material is not a database row of text fields. It’s the actual multi-spectrum optical captures used by anti-fraud scanning hardware, at a scale, per Krebs’s reporting, that touches roughly half the adult population of the United States and Canada combined. That’s a different category of harm than a leaked password table, and it’s one the existing breach-notification and credit-monitoring playbook wasn’t really designed around.

Market and Regulatory Fallout for the KYC Industry

The timing is awkward for the identity-verification sector generally. A growing number of US states have passed or proposed laws requiring platforms to collect driver’s-license scans to verify a user’s age before granting access to certain online services, expanding exactly the kind of centralized document-collection infrastructure now under scrutiny. Privacy advocates, including the Electronic Frontier Foundation, have warned for months that mandates like these multiply the number of places a driver’s license image can end up stored and potentially breached.

Security researcher Zach Edwards, who worked with Krebs on tracing the leak, put the policy stakes directly in comments reported by IBTimes: “This episode should further strengthen the resolve for people who are fighting back against online ID schemes which are requiring countless providers to ask for driver’s licenses in order to access services under the guise of protecting kids.” Expect that argument to feature heavily in state legislative sessions and in FTC-facing complaints over the coming months, alongside renewed scrutiny of how long identity-verification vendors are allowed to retain document images after a transaction is complete.

The IDScan.net incident also lands alongside a broader pattern of 2026 breaches at data-handling vendors, including the McKesson breach and the Aesto Health breach, both of which exposed tens of millions of records held by third-party processors rather than the consumer-facing brands people actually recognize. It follows the FBI’s own separate confirmation, covered in our earlier report on the bureau’s investigation, that the scale of the exposure is still being assessed.

What Affected Consumers Can Actually Do Right Now

The honest answer is: not much, yet. There is currently no public breach-notification portal, no confirmed victim list, and no official disclosure from IDScan.net establishing scope. The FBI has not issued consumer guidance specific to this incident. Standard identity-protection steps still apply and are worth taking regardless of whether your data is confirmed to be involved:

• Place a fraud alert or credit freeze with the major credit bureaus if you have recently rented a vehicle through Hertz or presented ID at a licensed cannabis dispensary
• Monitor bank and credit accounts for new-account fraud or unfamiliar loan applications
• Watch for phishing attempts that reference specific personal details, a sign your data may have circulated beyond the original marketplace
• Be aware that document-based identity checks (video KYC, selfie-matching) carry elevated forgery risk while this data remains in circulation

None of this fully addresses the deeper problem: financial-fraud protections don’t cover physical document forgery or biometric impersonation at a point-of-sale scanner, which is the risk this specific breach format actually raises. Businesses on the other side of this equation, meanwhile, can start by running their own vulnerability scan against any third-party verification integration they depend on, and by tracking broader cybersecurity threats that increasingly target compliance vendors rather than the brands consumers deal with directly.

Five Predictions for What Happens Next

1. Congressional interest follows the Hegseth detail. A cabinet official’s data surfacing in a criminal marketplace typically draws committee attention faster than a purely consumer-facing breach would.
2. State attorneys general open parallel inquiries. Multiple states have consumer-protection statutes covering unnecessary retention of biometric and identity data, and this incident gives regulators a clean test case.
3. Enterprise clients quietly audit their vendor contracts. Companies that outsourced ID verification to IDScan.net or similar vendors will face pressure to demand proof of data-minimization and deletion policies, whether or not they were directly implicated.
4. mDL adoption gets a policy tailwind. Expect state DMV and merchant-side pilots of cryptographic mobile credentials to be cited more often in legislative debate as the lower-risk alternative to document scanning.
5. The data keeps circulating regardless of Nexus going offline. A marketplace disappearing after public exposure is not the same as the underlying dataset being destroyed. Expect the same records to resurface under different marketplace names in the coming months.

Frequently Asked Questions

What is Nexus, and is it still active?
Nexus was a dark-web marketplace advertised on the Exploit cybercrime forum that offered a searchable index of scanned identity documents. According to reporting, the public-facing site went offline shortly after Brian Krebs published his investigation this week, though the underlying data may still be circulating through other channels.

Is IDScan.net confirmed as theed data to IDScan.net based on victim patterns tied to Hertz rentals and cannabis-dispensary ID checks, and IDScan.net has said it is investigating, but the company has not published an official statement confirming a breach or identifying a root cause

Was Defense Secretary Pete Hegseth’s data actually confirmed in the database?
According to IBTimes’s reporting on the incident, personal identification records belonging to Hegseth were found in the Nexus database. The Department of Defense did not respond to requests for comment on the matter.

What is the FBI doing about it?
The FBI’s New Orleans field office confirmed it opened an investigation and said it was looking into the incident, declining further comment due to the ongoing nature of the case. No consumer-facing guidance has been issued yet.

How is this different from a typical password-based data breach?
The exposed material reportedly includes multi-spectrum image captures (visible light, infrared, and ultraviolet) of physical identity documents, the same data anti-fraud scanning hardware uses to verify authenticity. Unlike a password, this data cannot be reset, which raises the stakes for downstream identity fraud.

Should I be worried if I’ve rented from Hertz or visited a cannabis dispensary recently?
Reporting has identified a pattern connecting confirmed victims to those two transaction types specifically, since both commonly rely on IDScan.net-style verification hardware. If you fall into either category, monitoring your credit and watching for phishing that references personal details is a reasonable precaution.

Does this affect mobile driver’s license (mDL) programs?
Not directly. mDL systems are designed specifically to avoid the centralized image-storage model implicated in this breach, since they confirm credential validity cryptographically without transmitting a document image. Expect this incident to be cited as an argument for accelerating mDL adoption.

What should businesses that use third-party ID verification vendors do now?
Security researchers who have covered the incident recommend that enterprise clients revisit vendor contracts to confirm data-minimization practices, retention limits, and breach-notification obligations, rather than assuming compliance outsourcing also outsources liability.