Stolen infrared and UV scans put the document check itself inside the IDScan.net breach

On August 31, 2026, a newly registered user on the Russian-language cybercrime forum Exploit advertised a service called Nexus offering searchable access to identity records on more than 170 million people in North America.

The Nexus listing advertised more than 153 million driver's licenses, more than 10 million state identification cards, more than three million travel documents and international IDs, and at least 579,000 medical cards including marijuana dispensary cards.

A spokesperson for the FBI's New Orleans Field Office said the bureau "can confirm that it is looking into the incident" and declined to comment further, citing the ongoing investigation.

A blank search of the Nexus interface returned approximately 11.5 million pages of results at roughly 15 records per page.

The Nexus record for Brian Krebs's driver's license included six image files: three pairs of front and back photos comprising a basic image scan plus infrared and ultraviolet versions, with a date and timestamp appended to each image filename.

IDScan.net's documentation confirms multi-spectrum ID scanning using infrared and ultraviolet light.

IDScan.net's website says its products catch fake IDs, scan employee cards for building access, and age-verify entry to websites and venues.

IDScan.net's public client roster lists Hertz, Target, FedEx, Caesars Entertainment, Motorola Solutions and financial services firm Jack Henry.

IDScan.net told Krebs it verifies more than 1,000 dispensaries across 19 states.

The Nexus operators wrote in their introductory post on Exploit: "We have been continuously exfiltrating new data for over a year into our private database."

Over 24 hours of Krebs's monitoring, the number of driver's license records listed as available in Nexus increased by nearly 400,000.

There were no passports in the Nexus data set, only some of the people who assisted Krebs had shown a driver's license at the airport on their travel date, and one person whose license appeared had not flown recently but had been renting a car from Hertz for several months around the date of their timestamp.

Krebs, nine friends and family members and additional collaborators cross-referenced the filename timestamps against calendars, travel records and car rental receipts, and the pattern consistently matched occasions when the person had presented a physical license to a Hertz rental car representative rather than at an airport checkpoint.

Krebs's own timestamp corresponded to a June 2025 trip to the Midwest for a family funeral, and his mother's license appeared with timestamps seconds apart from his, matching the window when both handed licenses to the same Hertz representative at the same counter.

Zach Edwards, a staff threat researcher at InfoBlox, found his own license in Nexus with a timestamp from his August 2026 trip to Las Vegas for DEFCON, and his record pointed to a Las Vegas cannabis dispensary called Planet13.

Krebs showed a Minnesota driver's license issued to U.S. Defense Secretary Pete Hegseth as an example from the Nexus listing.

Krebs said an assistant FBI director was among the people whose information appeared for sale on the dark web service.

IDScan.net said it is notifying potentially impacted individuals and providing access to free credit monitoring and identity protection services.

Some Nexus records carried the source notation "CAC," which Krebs wrote may refer to Common Access Cards, government-issued identity cards that grant physical access to government buildings and secure rooms.

IDScan.net said that after Krebs's report it took "immediate steps" to secure its systems, engaged a team of third-party specialists to determine the full nature and scope of the incident, and is cooperating with federal law enforcement.

IDScan.net executive Jillian Kossman told KrebsOnSecurity the firm was investigating the breach, and she and other company officials did not respond to multiple phone and emailed inquiries from The Times-Picayune.

The people behind Nexus claimed the license images came from an active breach at "a major identity verification company" whose customers include multiple Fortune 500 companies.

About 11.5 million pages at roughly 15 records per page implies approximately 172.5 million records, consistent with the advertised total of more than 170 million people.

IDScan.net reports more than 21 million verifications monthly at over 20,000 locations worldwide.

Spread evenly over one year, 153 million licenses averages about 419,000 records a day, comparable to the nearly 400,000 growth observed in 24 hours.

Edwards said "There's never been a breach of drivers license data at this scale, and the threat actors behind this seem to be both sophisticated and also financially motivated, which is a bad sign for any efforts to prevent the data from spreading further," and that all victims he communicated with traced their breaches back to IDScan vendors.

IDScan.net said that while the investigation is ongoing it has determined an unauthorized third party may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud, and that the types of information may include full names and driver's license or other government-issued identification numbers.

153 million driver's licenses is roughly 7.3 months of IDScan.net's stated verification volume of more than 21 million per month.

Tech Times reported that the stolen images include the infrared and ultraviolet captures banks and government agencies use to verify documents are real, meaning the stolen data can potentially defeat the authentication systems designed to stop fakes.