Summary

• Nexus, advertised on the Russian-language cybercrime forum Exploit, claimed documents for more than 170 million people in North America.
• The listing included more than 153 million driver’s licenses, 10 million ID cards, 3 million travel documents and about 579,000 medical cards.
• Some records included front and back images plus infrared (IR) and ultraviolet (UV) scans, the imagery ID verification systems use to validate physical documents.
• Timestamps on stolen images matched ID scans at Hertz rental counters and a Planet13 dispensary, pointing to IDScan.net as the likely source.
• Nexus went offline after the report, but the data is likely to resurface. Organizations that rely on ID documents should expect more convincing fraud and phishing.

What happened in the IDScan.net and Nexus leak?

Nexus, a new identity theft service on the Exploit forum, sold searchable access to identity documents and claimed it had been continuously exfiltrating new data for more than a year. Security journalist Brian Krebs reported that the number of listed licenses grew by nearly 400,000 in 24 hours, which suggests an ongoing compromise rather than a one-time leak.

Krebs began investigating after a source told him his own Virginia driver’s license was being offered as a free sample. By matching image timestamps with the dates and times people had their IDs scanned at Hertz counters and a Planet13 dispensary, he traced the apparent source to IDScan.net, a Louisiana-based identity verification company. TechCrunch also reported that the evidence pointed to a breach of a major ID verification service.

The listing claimed:

• More than 153 million driver’s licenses.

• More than 10 million ID cards.

• More than 3 million travel or international identity documents.

• About 579,000 medical cards.

  

Leaked data breakdown

Shortly after the KrebsOnSecurity report, Nexus replaced its login page with the message “This service is no longer available.”

Who is investigating, and what are the lawsuits about?

The FBI’s New Orleans field office opened an inquiry into the incident. Krebs reported that records of high-ranking US government officials, reportedly including Defense Secretary Pete Hegseth, appeared in the dataset.

Consumers in California, Florida, Georgia and Louisiana filed lawsuits alleging that IDScan.net failed to protect sensitive data and likely violated Federal Trade Commission (FTC) data security guidelines. The plaintiffs seek damages and court-ordered security improvements.

Why are identity verification vendors such attractive targets?

An identity verification vendor processes ID checks for thousands of businesses, so one compromise exposes all their customers. Attackers do not need to breach every rental counter, hotel or dispensary. They only need the shared service behind them.

Partners of ID Scan

ID scanning is now routine in car rentals, hotels, dispensaries, financial services, age-restricted platforms, travel and marketplace onboarding. Each use reduces fraud at the counter but adds to a central store of sensitive data. The more trust and scale a provider accumulates, the more valuable a compromise becomes.

Why is a leaked driver’s license worse than a leaked password?

A password can be reset, but a driver’s license bundles a legal name, date of birth, address, photo, document number and issuing authority that a person cannot easily change. Many organizations still treat it as strong proof of identity.

Replacing the license changes the document number, but the exposed image and personal details can still be abused. That is why the impact of an ID document leak lasts much longer than a credential leak.

What can attackers do with stolen ID scans?

Stolen ID scans give attackers verified personal details they can use to pass weak checks and make impersonation believable:

1. Account opening fraud: submitting stolen document images to open accounts or apply for credit.
2. Account recovery attacks: sending a matching ID image to a support team to take over a victim’s account.
3. Targeted phishing: using real names, addresses and license details to make messages look legitimate, especially when combined with other breach data.
4. Executive and public figure targeting: using exposed IDs of executives and officials for impersonation, doxxing or physical security threats.
5. Bypassing weak KYC (Know Your Customer) checks: reusing images where verification only checks that a document looks valid, without liveness, device or behavior signals.

What should organizations that collect ID documents do now?

Organizations that collect or rely on ID documents should reduce what they store and assume the leaked data will be used against their customers. In order of priority:

1. Review what you collect. If the business only needs a verification result, do not keep the document image.
2. Minimize retention. Set clear retention windows and delete raw images once legal, compliance or fraud review needs end.
3. Reassess vendor exposure. Ask verification providers what they store, for how long, whether they keep raw images, whether they support deletion or tokenized verification, and how they log and monitor access.
4. Strengthen account recovery. Do not accept a government ID alone. Combine known-device checks, recent activity, step-up authentication and manual review for high-risk cases.
5. Monitor for impersonation. Watch for lookalike domains, fake support portals, executive impersonation, fraudulent onboarding attempts, social media impersonation and credential harvesting pages that use breached personal data.
6. Prepare customer guidance. Explain what happened, what data may be at risk and what people can realistically do.

What should individuals do if their ID may be exposed?

People who think their license may be in the dataset should focus on blocking new-account fraud and spotting targeted phishing:

• Place a credit freeze with the major credit bureaus.
• Monitor bank accounts and credit reports.
• Be skeptical of messages that contain accurate personal details.
• Watch for account recovery notices you did not request.
• Use unique passwords and multi-factor authentication (MFA) on important accounts.
• Report suspected identity theft at IdentityTheft.gov in the US or through the Office of the Privacy Commissioner of Canada.

How PhishFort helps after an identity data leak

Leaked identity data makes brand and executive impersonation more convincing. PhishFort Executive Protection detects and removes fake profiles and doxxing that target executives, and PhishFort Dark Web Monitoring watches underground sources for credential and identity data tied to your brand.

Frequently asked questions

Was IDScan.net hacked?

KrebsOnSecurity traced the Nexus data to IDScan.net by matching image timestamps with real ID scans at Hertz and a Planet13 dispensary. The FBI’s New Orleans field office opened an inquiry, and consumer lawsuits allege the company failed to protect the data.

How many driver’s licenses were exposed in the Nexus leak?

Nexus claimed more than 153 million US and Canadian driver’s licenses, plus more than 10 million ID cards, 3 million travel documents and about 579,000 medical cards, covering more than 170 million people.

What can criminals do with a scanned driver’s license?

Criminals can use stolen license scans to open accounts, pass weak KYC checks, take over accounts through support teams and make phishing messages more believable. Executives and officials face added impersonation and physical security risks.

Does getting a new driver’s license protect me?

Only partly. A new license changes the document number, but the leaked image, name, address and date of birth can still be used for fraud, so credit freezes and monitoring remain important.

Sources

• KrebsOnSecurity: FBI probes service selling 153M driver’s licenses
• TechCrunch: It sure looks like hackers breached a major ID card verification service (September 2, 2026)
• USA.gov: Identity theft
• Office of the Privacy Commissioner of Canada: Identity theft guide