IDScan suspected of leaking over 170 million document scans

The dark web service Nexus is selling scans of identity documents for over 170 million North American residents, including more than 153 million U.S. and Canadian driver's licenses. Investigative leads point to Louisiana-based identity verification provider IDScan.net, but the extent of the leak and the intrusion path have not been officially confirmed by the company.

Nexus claims its database also contains over 10 million identity documents, more than 3 million travel documents or international IDs, and at least 579,000 medical cards; according to its promotional claims, the total number of identity documents in the database far exceeds the 153 million driver's licenses. The service appeared on the Russian cybercrime forum Exploit, allowing paying users to preview partially obscured records.

KrebsOnSecurity verified with multiple individuals listed in the database and found that some driver's license scan images matched the times they presented their documents at car rental counters and cannabis dispensaries. The leaked images contain infrared and ultraviolet scanning features, consistent with how IDScan's document verification systems are used in car rental, retail, and regulated industries.

The FBI's New Orleans office has launched a formal investigation into the suspected data breach involving IDScan.net. IDScan.net stated it was verifying the information but did not confirm unauthorized access, nor did it provide substantial details on the specific affected data, duration of the attack, system entry points, or involved clients.

Nexus operators claim they have been continuously leaking new data for over a year, with the number of driver's license records increasing by nearly 400,000 within 24 hours; this implies that if the claim is true, the risk is not just a one-time historical database leak but may involve ongoing data collection or unblocked access channels. This claim comes from criminal service operators and has not been independently verified by law enforcement or IDScan.

Based on a rough estimate of about 500KB per scan, the data volume for just 153 million driver's licenses is approximately 76.5TB; if identity cards, travel documents, and medical cards are included, the theoretical original image size could be even higher. However, file size depends on resolution, compression rate, number of front and back images, infrared and ultraviolet layers, and metadata, so the actual leaked scale cannot be confirmed based on this.

Reports indicate that IDScan processes over 21 million document verifications monthly, with deployment in over 20,000 locations, covering industries such as car rental, retail, logistics, and entertainment. If its identity image database is continuously extracted, attackers would obtain not just ordinary name and email leaks, but high-value document images that can be used for identity forgery, bypassing KYC, applying for credit, account takeover, and social engineering attacks.

In market mechanics, identity theft gangs are the buyers of the leaked document databases, while Nexus and potential data thieves are the sellers; funds flow through dark web subscriptions or per-record purchases to criminal services. Victims face risks of new account openings, synthetic identities, SIM card hijacking, bank account takeover, and medical identity misuse, while businesses need to invest in identity verification upgrades, fraud payouts, customer notifications, and regulatory compliance. Beneficiaries include identity protection, anti-fraud, biometric liveness detection, device fingerprinting, and zero-trust security service providers; KYC processes relying on static document photos as the primary identity credential are under pressure.

Source: Public information