IDScan under fire over alleged breach affecting 153 million drivers

A newly launched dark web service is offering access to more than 153 million scanned U.S. and Canadian driver’s licenses, prompting an FBI investigation into an apparent breach at identity verification company IDScan.net.

The massive trove was uncovered by KrebsOnSecurity was alerted to the existence of a service called Nexus, claiming to hold identity documents belonging to more than 170 million people across North America. The service offered more than 153 million driver’s licenses, along with millions of other identification and medical documents.

The FBI's New Orleans field office has since opened an official investigation into an apparent breach involving IDScan.net. The company has said it is investigating but has not provided a substantive public response to questions about the incident.

The Data Appears to Be Fresh

One of the most alarming aspects of the discovery is that the database does not appear to be a static collection of old records.

According to KrebsOnSecurity, the number of available driver’s licenses increased by nearly 400,000 in just 24 hours, suggesting that newly stolen data may have been continuously uploaded to the service.

The criminals behind Nexus claimed they had been exfiltrating new information for more than a year. Records reportedly include high-resolution scans, including front and back images, as well as infrared and ultraviolet versions of some licenses. Many files also contain timestamps corresponding to when the documents were scanned.

Krebs and other researchers were able to match those timestamps against real-world activities, including car rentals and other situations where people handed over their licenses.

IDScan Emerges as the Suspected Source

The investigation points toward IDScan.net because several records appear to line up with transactions involving companies known to use its identity verification technology.

IDScan says its systems process more than 21 million identity verifications every month across more than 20,000 locations worldwide. Its customers include major companies such as Hertz, Target, FedEx and Motorola Solutions.

Krebs also found evidence linking some records to Planet13, a cannabis retailer that uses IDScan's technology to verify customers.

IDScan has not confirmed that its systems were breached.

Why the Leak Is So Dangerous

Driver’s licenses are more than identification cards. They can be used to verify identities when opening accounts, accessing services and resetting credentials.

Security researchers warn that the exposure could therefore fuel identity theft, fraud and account takeovers. It could also put people at particular risk who depend on keeping their identities private, including domestic violence survivors and individuals in witness protection.

Shortly after Krebs published his investigation, the Nexus service disappeared from the dark web.

But the disappearance does little to solve the bigger problem. If the database was genuinely stolen from an identity verification provider, millions of people's identities may now be circulating far beyond the systems originally trusted to protect them.