Another week, another company hands your personal information to criminals. This time nobody has to guess what the data is worth, because it was already priced and listed for sale.
On September 1, a dark web service calling itself Nexus went live advertising searchable access to more than 153 million scanned driver's licenses belonging to people in the United States and Canada. The FBI's New Orleans field office opened an investigation the same day.
What Happened
On August 31, a new user on a Russian cybercrime forum began advertising access to digital scans of identity documents on more than 170 million people in North America. The seller offered a free sample to prove the goods were real. That sample was the Virginia driver's license of Brian Krebs, the investigative journalist who has spent two decades exposing exactly this kind of operation.
Krebs ran a blank search on the service. It returned roughly 11.5 million pages of results at about 15 results per page. Whatever else is true, the seller was not inflating the number.
The trail led to IDScan.net, a New Orleans identity verification company whose clients include Hertz, Target, FedEx, and cannabis dispensaries. The company says it is investigating. The Nexus site went dark shortly after the story broke, which changes nothing. The data was copied long before anyone noticed. The seller claimed to have been pulling new records out of a live system for over a year.
What Was Exposed
According to the listings, the collection includes:
More than 153 million driver's licenses from the United States and Canada
More than 10 million state identification cards
More than 3 million travel documents and international IDs
At least 579,000 medical cards, including dispensary cards
The driver's license of the Secretary of War was in there, offered for $100.
Why This One Is Different
Most breaches leak text. A name, a number, a date of birth typed into a database field. This one leaked pictures.
Individual records reportedly contain six separate images of a single license. Front and back under normal light, front and back under infrared, front and back under ultraviolet. That is not a phone snapshot. That is the output of the multi-spectrum scanners sitting on counters at rental car agencies, casinos, and dispensaries, the machines built to read the holograms and security laminates a copy machine cannot reproduce.
In other words, this is not a list of license numbers. It is a forgery kit, with the anti-counterfeiting features included.
Who Is Affected
Anyone who has handed over a license to be scanned. Renting a car. Checking into a hotel. Buying at a dispensary. Verifying your age for an app or a sportsbook. Most people have no idea which vendor processed that scan, and that is the point. You never chose IDScan.net. You chose Hertz, and Hertz chose them.
There is no confirmed list of affected people and no legitimate lookup tool. Be extremely careful with any site claiming it can check whether your license is in the set. Fraudsters follow these stories closely, and "enter your license number to see if you were breached" is a scam that writes itself.
What This Means For You
Your license number cannot be reset. Neither can your date of birth, your face, or the address printed on the front. When a password leaks, you change it in ten seconds. When a scanned government ID leaks, it stays valuable to criminals for as long as that document is valid, and often longer.
But a stolen license image alone is a document. What turns it into a weapon is everything else about you that is already sitting online for free. Your current address. Your phone number. Your relatives. Your employer. That information does not come from a breach. It comes from data brokers and people-search sites that collect it legally and publish it for anyone to search.
A criminal with your license scan and your broker profile has enough to open accounts, take over existing ones, and pass a verification call. A criminal with just the scan has a picture.
You cannot pull your license back off a dark web market. You can take away the other half.
Patriot Protect finds your personal information across Google and more than 200 data broker and people-search sites and forces its removal. When it reappears, we remove it again. We have removed millions of records for families and individuals, and we are 100% USA based.
Get protected at https://patriot-protect.com/pages/purchase-your-protection