Dark web store is selling 153 million US and Canadian drivers licence scans, FBI opens probe

Key points

• A new dark web service called Nexus is selling digital scans of more than 153 million drivers licences from people in the United States and Canada, plus 10 million ID cards and 579,000 medical cards.
• The FBI's New Orleans field office opened an inquiry on September 2, 2025 into where the images came from.
• Records include scans belonging to US Defense Secretary Pete Hegseth and other senior federal officials.
• Timestamps on the images match car rentals at Hertz counters and visits to Planet13 cannabis dispensaries, both of which use Louisiana-based identity verification firm IDScan.net.
• The listing grew by roughly 400,000 licences in 24 hours, suggesting the source system is still leaking.

A criminal marketplace calling itself Nexus appeared on the Russian-language hacking forum Exploit on August 31, 2025, offering to sell high-resolution scans of drivers licences belonging to more than 153 million people across the United States and Canada.

The seller also lists over 10 million state ID cards, more than three million passports and international IDs, and at least 579,000 medical cards. A blank search on the site returns roughly 11.5 million pages of results.

One of the sample licences shown in the sales pitch belongs to US Defense Secretary Pete Hegseth. Others belong to senior federal employees.

The FBI's New Orleans field office has opened an official inquiry, first reported by KrebsOnSecurity, which also broke the existence of the marketplace after its own reporter's licence turned up in the free samples.

How did the criminals get the scans?

The evidence points to a breach at a third-party identity verification company, not a hack of any government agency. The Nexus operators say they have been "continuously exfiltrating new data for over a year" from what they describe as a major identity verification vendor used by Fortune 500 clients.

That claim lines up with the timestamps on the stolen images. Each record contains up to six image files: a plain scan of the front and back of the licence, plus infrared and ultraviolet versions of the same document. Those are the exact outputs of a professional ID-scanning device, the kind sat on a counter at a car rental desk or a dispensary.

Reporters and researchers who found their own licences in the database confirmed the dates match specific moments when they physically handed a licence to a business. Two federal employees whose scans appear in Nexus said they used passports at airport security but rented cars from Hertz on the same day. One person had not flown at all, but had a months-long Hertz rental active during the timestamp window.

Security researcher Zach Edwards found his licence in the store with a timestamp from DEF CON week in Las Vegas. He did not rent a car. The only place he says he watched staff feed his licence into a scanning device was Planet13, a large cannabis dispensary chain.

Why does IDScan.net keep coming up?

Both Hertz and Planet13 use the same vendor. IDScan.net, based in New Orleans, announced an exclusive verification deal with Planet13 in 2022 and says it now processes ID checks for more than 1,000 dispensaries across 19 US states. The FBI office handling the probe is also in New Orleans, which is unlikely to be a coincidence.

IDScan.net has not publicly confirmed a breach.

What was actually exposed?

Record type	Count listed on Nexus
US and Canadian drivers licences	153 million+
State and national ID cards	10 million+
Passports and international IDs	3 million+
Medical and dispensary cards	579,000+
New licences added in 24 hours	~400,000

Some records are tagged "CDL" (commercial drivers licence) or "CAC," which likely refers to Common Access Cards, the ID badges that let US defence staff into secure buildings.

What should affected people do?

A stolen licence scan is more damaging than a leaked password. Criminals use these images to open bank accounts, file fake tax refunds, and pass "know your customer" checks at crypto exchanges.

If you have rented from Hertz or visited a dispensary that scans IDs in the past year, place a free credit freeze at all three US credit bureaus (Equifax, Experian, TransUnion), or Equifax and TransUnion in Canada. Turn on IRS Identity Protection PINs if you file US taxes. Treat any call, text or email asking you to "verify your identity" with heavy suspicion for the next year or two. State DMVs will reissue a licence with a new number if you can show evidence of identity theft, though the photo on file does not change.

Regulatory jurisdiction here is layered. The FTC will likely lead on US consumer harm, state attorneys general have their own breach-notification statutes, and Canadian records fall under the Office of the Privacy Commissioner. Ontario alone accounts for 473,673 of the Canadian records.