The Nexus dark‑web listing contained 153 million scans
A marketplace on the dark web called Nexus was advertising a database that allegedly holds over 153 million U.S. and Canadian driver’s licence scans, plus millions of other identity documents.
What the lawsuit says
Two lawsuits filed in Louisiana accuse IDScan of failing to protect client information. The complaints allege that the breach exposed more than 153 million driver’s licence images, 10 million ID cards, 3 million travel documents and 579 000 medical cards.
How the leak was confirmed
Security journalist Brian Krebs reported the leak on September 1. He verified a sample of records by searching the Nexus database for his own data and for data belonging to consenting individuals.
The FBI’s New Orleans office opened an investigation, a fact confirmed by Reuters and by the bureau itself.
Technical snapshot
- Data source: IDScan’s hardware and software solutions that capture images of government‑issued IDs.
- Data types exposed: driver’s licences, state ID cards, passports, travel documents, medical cards.
- Leak vector: unknown; the dark‑web service Nexus listed the database for sale.
- Current status: Nexus is no longer reachable, but the database is reportedly still accessible to threat actors.
Who is at risk
Any organization that used IDScan’s verification platform could see its customers’ personal documents exposed. That includes retailers, financial services, transportation firms and healthcare providers that rely on on‑site ID scanning.
Steps for affected businesses
- Assume the data is compromised and begin a breach response plan.
- Notify affected customers promptly; IDScan reportedly started notifying some business clients around September 1.
- Review access controls on IDScan integrations and consider temporary suspension until the investigation clarifies the attack surface.
- Offer credit‑monitoring or identity‑theft protection to individuals whose documents were scanned.
- Work with legal counsel to assess liability and coordinate with law‑enforcement.
While IDScan has not issued a public comment, the lawsuits and the FBI probe underscore the need for tighter safeguards around large‑scale identity‑verification deployments.