153 million license scans for sale, and the infrared images name the source

Brian Krebs reports that a dark web service called Nexus is selling digital scans of more than 153 million drivers licenses from the United States and Canada, alongside more than 10 million ID cards, three million travel documents and 579,000 medical cards. The FBI’s New Orleans field office opened an investigation on September 1. Krebs’s own Virginia license was the free sample in the seller’s introductory post on the Russian cybercrime forum Exploit. The record count grew by roughly 400,000 in the 24 hours he spent looking at it. Via Daring Fireball.

How he identified the source is the part to read. Each record carries six image files — front and back, a plain scan, and infrared and ultraviolet versions — with GMT timestamps in the filenames. Nine people who let Krebs search for their licenses confirmed the timestamps matched a car rental or a dispensary visit. Krebs and his mother handed their licenses to the same Hertz counter agent; their timestamps are seconds apart. Infrared and ultraviolet capture is documented on idscan.net’s own site. The New Orleans company says it performs more than 21 million verifications a month at over 20,000 locations, runs ID checks for more than 1,000 dispensaries across 19 states, and lists Hertz, Target, FedEx, Motorola Solutions and Jack Henry as customers. Caesars Entertainment, also listed, told Krebs it has not used the product since February 2025.

This is the supply side of the identity-document problem, and it is a byproduct of verification rather than a failure of it. Every scheme answering an identity question by capturing a license image — age gating, KYC onboarding, account recovery, rental counters — adds a vendor holding the file. Larry Baldwin of Cybera, whose own license is in the set with a Hertz timestamp, put it to Krebs this way: “Just when it seems like we’re making some headway in improving authentication controls through drivers license verification systems, this happens and the very thing those improvements are dependent on are compromised.”

Records in the set include the drivers licenses of the US Defense Secretary and the assistant director of the FBI. The Nexus site disappeared from the dark web shortly after Krebs published.