153M ID Scans Surface on Dark Web, Traced to Vendor IDScan.net; FBI Opens Probe

A newly launched dark web service called Nexus is offering digital scans of more than 153 million U.S. and Canadian driver’s licenses, alongside millions of ID cards, travel documents, and hundreds of thousands of medical and dispensary cards. The listings are unusually rich: each record can include front-and-back scans plus infrared and ultraviolet captures, timestamped and often paired with the cardholder’s photo. The operators claim they’ve been quietly exfiltrating data for over a year from an unnamed identity-verification firm serving Fortune 500 clients, and the catalog is still growing by roughly 400,000 records a day. The FBI’s New Orleans field office has opened an inquiry.

Reporting by Brian Krebs points to idscan.net, a Louisiana-based identity-verification vendor, as the likely source. By cross-checking timestamps against the travel records of volunteers whose licenses appeared in Nexus, Krebs found the scans consistently traced not to airport TSA checkpoints but to moments when people handed their licenses to third parties — most often Hertz car-rental counters and a Las Vegas marijuana dispensary. IDScan’s own marketing corroborates the link: it lists Hertz, Target, FedEx, and Caesars among its customers, processes ID checks for more than 1,000 dispensaries, and uses the same infrared/ultraviolet scanning that shows up in the leaked files. The company says it is investigating but has not issued a substantive statement.

The incident underscores the outsized risk concentrated in identity-verification middlemen. A single vendor sitting behind thousands of retail, rental, and dispensary checkpoints becomes a single point of failure — and when it’s breached, victims have no practical way to rotate a driver’s license the way they would a password. The presence of records tagged as commercial licenses and possibly government Common Access Cards raises the stakes further, turning a routine ID swipe at a rental counter into durable, high-fidelity material for identity fraud.