Brian Krebs found his own driver’s license on a stranger’s sales page. The Virginia driver’s license of the veteran security reporter had been posted as a free sample by a new user on Exploit, a Russian cybercrime forum, to advertise a service called Nexus. That was Monday, August 31, 2026. By September 1 the FBI’s New Orleans field office had opened a formal investigation.
Nexus claimed to hold more than 153 million scanned driver’s licenses from the United States and Canada. It also listed more than 10 million identification cards, more than three million travel documents or international IDs, and at least 579,000 medical cards. Krebs wrote that the operators said the total was growing by roughly 400,000 a day, and blamed a live breach that, they said, had been running for over a year.
How Krebs traced it
Each record held six images of a license: front and back, in visible, infrared and ultraviolet light, plus a timestamp. Krebs’s timestamp matched a June 2025 flight and car rental. He checked nine friends and relatives; everyone who found a license confirmed a trip or car rental around the same date. His license and his mother’s, who rented a Hertz car with him, carried stamps only seconds apart.
Security researcher Zach Edwards, as Krebs reported,, whose license also turned up, narrowed it down. His timestamp matched a visit to Las Vegas for DEF CON in August, where he had shown his license at a Planet13 marijuana dispensary. In 2022 the identity verification firm idscan.net had announced an exclusive partnership with Planet13’s dispensaries. Its own documentation says its technology scans IDs with infrared and ultraviolet light, the same format seen in Nexus.
Krebs traced the source to IDScan.net, a New Orleans company. It performs more than 21 million verifications a month at more than 20,000 locations worldwide, and its clients have included Hertz, Target, FedEx, Motorola Solutions and Caesars Entertainment. The dataset reportedly held licenses belonging to Defense Secretary Pete Hegseth and an FBI assistant director, though not FBI Director Kash Patel’s. Some records carried the notation “CAC,” which could refer to Common Access Cards used to enter federal buildings.
The company and the FBI respond
The Nexus service went offline soon after Krebs published. On September 4, IDScan.net said that “on or around September 1, 2026” it received information that certain data “may have been accessed without authorization.” An unauthorized third party may have accessed or copied customer information in cloud accounts, including names and license or other government ID numbers. The company says it is working with law enforcement and outside specialists and will offer free credit monitoring to anyone whose data is confirmed involved.
The FBI told Newsweek it was “looking into the incident” but declined further comment. Federal authorities have not confirmed the size of the exposure. Several proposed class-action lawsuits accuse IDScan.net of failing to protect personal information; the company has admitted no wrongdoing.
For anyone worried, Newsweek’s advice was plain: watch credit reports and statements for accounts you did not open, and consider a fraud alert or a free credit freeze with each of the three major bureaus.
Sources
- Dark Web Service Nexus Sells 153M+ Driver's Licenses
- Driver’s License Data Breach: What to Do if Your Information Was Stolen – Newsweek
