Dark web service Nexus selling scans of over 170 million North American residents' identity documents, including over 153 million U.S. and Canadian driver's licenses
IDScan suspected of leaking over 170 million document scans
The dark web service Nexus is selling scans of identity documents for over 170 million North American residents, including more than 153 million U.S. and Canadian driver's licenses. Investigative leads point to Louisiana-based identity verification provider IDScan.net, but the extent of the leak and the intrusion path have not been officially confirmed by the company.
Nexus claims its database also contains over 10 million identity documents, more than 3 million travel documents or international IDs, and at least 579,000 medical cards; according to its promotional claims, the total number of identity documents in the database far exceeds the 153 million driver's licenses. The service appeared on the Russian cybercrime forum Exploit, allowing paying users to preview partially obscured records.
KrebsOnSecurity verified with multiple individuals listed in the database and found that some driver's license scan images matched the times they presented their documents at car rental counters and cannabis dispensaries. The leaked images contain infrared and ultraviolet scanning features, consistent with how IDScan's document verification systems are used in car rental, retail, and regulated industries.
The FBI's New Orleans office has launched a formal investigation into the suspected data breach involving IDScan.net. IDScan.net stated it was verifying the information but did not confirm unauthorized access, nor did it provide substantial details on the specific affected data, duration of the attack, system entry points, or involved clients.
Nexus operators claim they have been continuously leaking new data for over a year, with the number of driver's license records increasing by nearly 400,000 within 24 hours; this implies that if the claim is true, the risk is not just a one-time historical database leak but may involve ongoing data collection or unblocked access channels. This claim comes from criminal service operators and has not been independently verified by law enforcement or IDScan.
Based on a rough estimate of about 500KB per scan, the data volume for just 153 million driver's licenses is approximately 76.5TB; if identity cards, travel documents, and medical cards are included, the theoretical original image size could be even higher. However, file size depends on resolution, compression rate, number of front and back images, infrared and ultraviolet layers, and metadata, so the actual leaked scale cannot be confirmed based on this.
Reports indicate that IDScan processes over 21 million document verifications monthly, with deployment in over 20,000 locations, covering industries such as car rental, retail, logistics, and entertainment. If its identity image database is continuously extracted, attackers would obtain not just ordinary name and email leaks, but high-value document images that can be used for identity forgery, bypassing KYC, applying for credit, account takeover, and social engineering attacks.
In market mechanics, identity theft gangs are the buyers of the leaked document databases, while Nexus and potential data thieves are the sellers; funds flow through dark web subscriptions or per-record purchases to criminal services. Victims face risks of new account openings, synthetic identities, SIM card hijacking, bank account takeover, and medical identity misuse, while businesses need to invest in identity verification upgrades, fraud payouts, customer notifications, and regulatory compliance. Beneficiaries include identity protection, anti-fraud, biometric liveness detection, device fingerprinting, and zero-trust security service providers; KYC processes relying on static document photos as the primary identity credential are under pressure.
Source: Public information
ABAB AI Insight
The identity verification industry where IDScan operates originally relied on a key assumption: the combination of government-issued documents, machine-readable barcodes, photos, and infrared or ultraviolet anti-counterfeiting features is sufficient to prove that "the person presenting the document is the identity subject." This model has been widely adopted by industries such as Hertz car rental counters, liquor and cannabis retail, gambling, logistics, and other sectors requiring age or identity verification. If the dark web database is related to IDScan, it exposes not just a single enterprise client list, but the entire centralized data collection architecture of "physical document presentation - platform long-term image storage - subsequent repeated verification."
In terms of capital pathways, businesses pay identity verification providers to upload customer documents to meet KYC, age verification, anti-money laundering, and regulatory record-keeping requirements; providers aggregate images, OCR text, document anti-counterfeiting layers, and verification records into high-value databases. Once attackers obtain such a database, they can turn a single breach into a long-term, repeatedly sellable identity fraud material: driver's licenses support account openings and social engineering scripts, medical cards can be used for insurance and personal data cross-verification, and travel documents can be used for higher-risk cross-border identity forgery. The more centralized the database, the higher the marginal benefit of a single system breach, while victims cannot change their face, birth date, and historical document records like they can change a password.
Historically, Equifax leaked sensitive personal information of about 147 million people in 2017, exposing the structural risks of credit systems that centrally store social security numbers, birthdays, and addresses; the 2024 National Public Data incident showed that large-scale identity data can be packaged for synthetic identities and targeted fraud. The IDScan incident is more operational than common data leaks because document scans often contain photos, signatures, barcodes, document numbers, and visual information from both sides. Attackers do not need to piece together multiple leaked databases; they may directly obtain complete identity materials sufficient to pass low-quality manual reviews.
This is a case of capital concentration. Identity verification service providers reduce the cost of each merchant building their own KYC systems by centrally storing and processing massive amounts of documents, but they also concentrate the identity assets of hundreds of millions of people into a single attack target. Once static document images enter the criminal market, the credibility of traditional "uploading driver's license photos" style authentication will decline, and security spending will be forced to shift towards dynamic liveness detection, device behavior recognition, continuous transaction monitoring, and multi-factor authentication. The value of the identity industry will shift from "who stores the most documents" to "who can continuously assess real people, real intentions, and real risks when documents have been copied."
ABAB News · Cognitive Laws
The more concentrated the identity is stored, the more concentrated the risk is sold.
Password leaks can be changed, but document leaks will follow a lifetime.
Static identities are responsible for access, while dynamic behavior determines security.