Dark web store is selling 153 million US and Canadian drivers licence scans, FBI opens probe

Key points

• A dark web service called Nexus is selling digital scans of more than 153 million drivers licences from people in the United States and Canada, plus 10 million ID cards and 579,000 medical cards.
• The FBI's New Orleans field office opened an inquiry on September 2, 2025 into the source of the images.
• Records include a scan of US Defense Secretary Pete Hegseth's licence, along with those of other senior federal officials.
• Timestamps on the images match car rentals at Hertz counters and visits to Planet13 cannabis dispensaries, both clients of Louisiana-based identity verification firm IDScan.net.
• The listing grew by roughly 400,000 licences in 24 hours, suggesting the source system is still being drained.

A criminal marketplace calling itself Nexus appeared on the Russian-language hacking forum Exploit on August 31, 2025, offering high-resolution scans of drivers licences belonging to more than 153 million people across the United States and Canada.

The seller also lists over 10 million state ID cards, more than three million passports and international IDs, and at least 579,000 medical cards. A blank search on the site returns roughly 11.5 million pages of results.

One sample licence shown in the sales pitch belongs to US Defense Secretary Pete Hegseth. Others belong to senior federal employees. KrebsOnSecurity, which first reported the marketplace after its own reporter's licence turned up in the free samples, also broke the FBI inquiry.

How did the criminals get the scans?

Evidence points to a breach at a third-party identity verification company, not any government agency. Nexus operators claim they've been "continuously exfiltrating new data for over a year" from a major identity verification vendor whose customers include Fortune 500 companies.

That claim lines up with what's inside the records. Each entry contains up to six image files: a plain scan of the front and back of the licence, plus infrared and ultraviolet versions. Those are the exact outputs of a professional ID scanner, the kind sat on a counter at a car rental desk or a dispensary.

Reporters and researchers who found their own licences confirmed the dates match specific moments when they handed a licence to a business. Two federal employees whose scans appear in Nexus said they used passports at airport security but rented cars from Hertz that same day. One person hadn't flown at all, but had a months-long Hertz rental active during the timestamp window.

Security researcher Zach Edwards found his licence in the store with a timestamp from DEF CON week in Las Vegas. He hadn't rented a car. The only place he recalled staff feeding his licence into a scanning device was Planet13, a large cannabis dispensary chain.

Why does IDScan.net keep coming up?

Both Hertz and Planet13 use the same vendor. IDScan.net, based in New Orleans, announced an exclusive verification deal with Planet13 in 2022 and says it now processes ID checks for more than 1,000 dispensaries across 19 US states. The FBI field office handling the probe is also in New Orleans. IDScan.net hasn't publicly confirmed a breach.

We first reported on IDScan.net on 1 September 2026, when a separate breach case raised questions about the concentration of sensitive identity data at verification intermediaries.

What was actually exposed?

Record type	Count listed on Nexus
US and Canadian drivers licences	153 million+
State and national ID cards	10 million+
Passports and international IDs	3 million+
Medical and dispensary cards	579,000+
New licences added in 24 hours	~400,000

Some records are tagged "CDL" (commercial drivers licence) or "CAC," which likely refers to Common Access Cards, the ID badges that grant US defence staff access to secure buildings.

Should you worry?

A stolen licence scan does more damage than a leaked password. Criminals use these images to open bank accounts, file fraudulent tax refunds, and pass "know your customer" checks at crypto exchanges.

If you've rented from Hertz or visited a dispensary that scans IDs in the past year or two, place a free credit freeze at Equifax, Experian and TransUnion in the US, or Equifax and TransUnion in Canada. Enrol in an IRS Identity Protection PIN if you file US taxes. Any message asking you to "verify your identity" deserves hard suspicion for the foreseeable future. State DMVs will reissue a licence with a new number if you can show evidence of identity theft, though the photo on file doesn't change.

Regulatory jurisdiction is layered: the FTC will likely lead on US consumer harm, state attorneys general have their own breach-notification statutes, and Canadian records fall under the Office of the Privacy Commissioner. Ontario alone accounts for 473,673 of the Canadian records.

The plain read here is that identity verification intermediaries have become a single point of failure for tens of millions of people who never chose them, never heard of them, and have no way to opt out.