More than 153 million driver’s licenses up for sale
Someone on the Russian cybercrime forum Exploit is advertising a service named Nexus that lists digital copies of driver’s licenses from the United States and Canada. The catalog claims more than 153 million records, and a free sample of a Virginia license is posted as proof.
Why the FBI is involved
The New Orleans field office opened an official investigation after noticing that the Nexus listings appear to match data from idscan.net, a Louisiana‑based identity‑verification provider. idscan.net processes over 21 million verifications each month at more than 20 000 locations and counts firms such as Hertz, Target, FedEx, Motorola Solutions, Jack Henry and Caesars Entertainment among its customers.
What’s actually on the marketplace
Beyond driver’s licenses, Nexus advertises state‑issued ID cards, travel documents, medical cards and marijuana dispensary cards. Some entries note a source tag of “CDL” or “CAC.” Each record usually bundles several image files – a standard photo, an infrared version and an ultraviolet version – and the filenames contain timestamps.
In a single 24‑hour window the number of driver’s‑license records grew by roughly 400 000, suggesting fresh data is being added continuously.
Concrete examples
Two scans found on Nexus line up with recent real‑world activity. A driver’s‑license image labeled “Zach Edwards” carries a timestamp that matches a trip to Las Vegas, while a scan for “Larry Baldwin” aligns with a recent Hertz car rental.
Who should be on alert
Any organization that relies on idscan.net for identity verification should assume its data may be compromised until the investigation concludes. The breach potentially exposes personal identifiers for millions of customers, which could be leveraged for synthetic‑identity fraud, account takeover or social engineering.
Immediate defensive steps
- Contact idscan.net to confirm whether your account is affected and request any available breach notifications.
- Review recent transactions for anomalies, especially new accounts or changes to existing profiles that use driver’s‑license data.
- Implement multi‑factor authentication for any workflow that consumes idscan.net verification results.
- Consider augmenting identity checks with additional data sources (e.g., credit‑bureau verification, biometric factors).
- Monitor dark‑web forums and marketplaces for new Nexus listings that match your customers’ details.
Keeping a close eye on the fallout from Nexus will help limit the window of opportunity for fraudsters who now have a massive cache of authentic‑looking IDs.