153 Million Driver's Licenses Leaked, FBI Probes IDScan.net

What happened

A dark-web marketplace called Nexus surfaced on Aug. 31, 2026, on the Russian-language cybercrime forum Exploit, advertising searchable scans of more than 153 million U.S. and Canadian driver's licenses 101213. The seller also claimed to be holding more than 10 million other identification cards, upward of 3 million travel documents and international IDs, and at least 579,000 medical cards, including marijuana dispensary cards 101215. In its opening pitch on the forum, the operator claimed access to records tied to more than 170 million people across North America and said the data had been "continuously exfiltrating" for over a year 1012.

Investigative journalist Brian Krebs, who broke the story, found his own driver's license offered as a free sample and used that entry point to test the service's legitimacy 10. He recruited relatives and volunteers to search for their own documents, and nine people confirmed that timestamps embedded in the image files lined up with real trips, car rentals or other transactions 1017. Security researcher Zach Edwards found his own license in the database tied to a Las Vegas trip for the DEFCON conference, during which he had shown ID at a Planet 13 cannabis dispensary that uses IDScan.net's verification technology 1015. Krebs also noted the record count climbed by nearly 400,000 in a single day of monitoring, a detail widely repeated across outlets as evidence the underlying breach might still be active rather than a one-time dump 9121719.

Within hours of the reporting, Nexus vanished from the dark web, its login page replaced with a message reading "This service is no longer available" 101417. The FBI's New Orleans field office opened a formal inquiry into a suspected breach at IDScan.net, a Louisiana-based identity-verification firm, and a bureau spokesperson separately told Reuters it was "looking into the incident" 1011141920.

The IDScan.net connection

No single piece of evidence proves IDScan.net was the source; the case is built from circumstantial but consistent detail. The leaked files included matched sets of front-and-back images captured under ordinary, infrared and ultraviolet light — the same multispectral capture method IDScan.net's hardware uses to authenticate documents 101718. IDScan.net's own marketing lists Hertz, Target, FedEx, Motorola Solutions, Jack Henry and Caesars Entertainment among its clients, and the company says it performs more than 21 million verifications a month across more than 20,000 locations 1018. Multiple people who found their licenses in Nexus, including Krebs and his mother, said the only place they had handed over their physical ID around the matching timestamp was a Hertz rental counter 1013.

IDScan.net has not confirmed a breach. In a notice to clients quoted by Krebs, the company said it received information on Sept. 1 suggesting it "may be implicated" and that it was securing systems, preserving logs, notifying its cyber insurer, and bringing in outside counsel and a forensic firm, while stressing it had not yet determined the nature or scope of any incident 1011. Caesars Entertainment pushed back on one detail, telling Krebs it had not been an active IDScan.net customer since February 2025 despite being listed as a client on the company's site 10.

Why this alarms researchers

Zach Edwards, a threat researcher at Infoblox, told Reuters that "there's never been a breach of driver's licenses at this scale" and warned that it created genuine national-security exposure for high-profile individuals 161920. That concern was sharpened by reports that licenses belonging to Defense Secretary Pete Hegseth and an FBI assistant director turned up in the database, with Hegseth's listed for sale at $100 131517.

Unlike a stolen password, a driver's license cannot simply be reset — the underlying name, address, birth date, license number and photograph remain valid and reusable even after a physical card is replaced 17. Coverage from Tech Times and CyberInsider emphasized that the stolen infrared and ultraviolet captures are the same authentication layer that banks and other institutions rely on to catch forged documents, meaning the leaked images could theoretically be used to defeat the very systems built to stop identity fraud 1517.

This episode arrives amid a broader surge in reported breaches. CNBC reported that 2026 data-breach notices have already exceeded the prior year's total, with artificial intelligence increasingly implicated in attacks and a rise in malicious-insider incidents 9. The same period has seen a cluster of unrelated but sensitive exposures: Apollo disclosed that hackers stole names, addresses and Social Security numbers in a Wall Street-adjacent breach 2; genetic-testing firm Baylor Genetics reported roughly 2.8 million people affected 7; and third-party vendor breaches separately hit the Minnesota, North Dakota and New Hampshire state supreme courts 458.

Where the reporting agrees

Across wire, tech-trade and local broadcast coverage, the core facts are remarkably consistent. Every outlet cites the same figures — roughly 153 million driver's licenses, 10 million other ID cards, 3 million travel documents and 579,000-plus medical cards — all traced back to Krebs's original reporting 10121314151718. There is also wide agreement that Nexus appeared on the Exploit forum on Aug. 31, that it went offline shortly after Krebs published, and that the FBI opened an investigation through its New Orleans field office within days 10111214171920. Outlets from SecurityWeek to AppleInsider to regional Fox affiliates all converge on IDScan.net as the suspected source, based on the same body of circumstantial evidence Krebs assembled 1213141920. And nearly every account repeats the detail that record counts grew by hundreds of thousands within a day, framing it as a sign the underlying access point may not have been closed 9121719.

Where it doesn't

The disagreements are mostly matters of framing and certainty rather than competing facts. Reuters, as relayed by Fox affiliates in Seattle and Washington, D.C., is notably more cautious, stressing that "it's unclear who could be behind the site or how many ID cards have been exposed" and that the FBI declined to confirm specifics beyond "looking into the incident" 1920. Krebs's own reporting and the tech-trade outlets that followed it treat the 153-million figure and the IDScan.net link as strongly supported, even while acknowledging the company itself has not confirmed a breach 10111217. IBTimes goes further than most in stating plainly that neither IDScan.net nor law enforcement has verified the total record count, a caveat less prominent in outlets that repeat the number as settled fact in their headlines 14.

There is also a gap in how outlets treat the Caesars Entertainment detail: Krebs's update noting Caesars disputes being a current IDScan.net client appears only in his own reporting and is largely absent from the secondary coverage that otherwise recycles his findings 10. Similarly, only Tech Insider ventures a claim about the industry-standard notification timeline, describing IDScan.net's roughly 24-hour public acknowledgment as unusually fast compared with past vendor breaches — a comparative judgment none of the other outlets make 11.

The reading the evidence supports

The most defensible account is the cautious one: something real and serious happened, its scope is asserted by a criminal seller rather than confirmed by any institution, and IDScan.net is the best-supported hypothesis for the source without yet being the proven one. Krebs's methodology — testing his own document, recruiting independent volunteers, and cross-referencing timestamps against real-world travel and rental records — is far more rigorous than a bare marketplace claim, and it is why every other outlet essentially defers to his findings rather than doing independent verification. But the 153-million figure originates entirely from the criminals' own listing, and IDScan.net's measured, lawyered statement is consistent with a company that has not yet confirmed what happened internally. The FBI's rapid, named field-office investigation signals that authorities consider the claims credible enough to act on, not that the scope has been established. Until IDScan.net or investigators confirm a root cause and a verified record count, the honest posture — one Reuters and IBTimes take more explicitly than most — is that this is a substantiated dark-web claim under active federal investigation, not a closed case.