"We have been continuously exfiltrating new data for over a year into our private database," the service enthused in its introductory post on Exploit, announcing access to millions of scanned identity documents.
The Nexus service on Exploit and its claims
A newly advertised service calling itself Nexus surfaced this week on the Russian cybercrime forum Exploit, offering digital scans of more than 153 million drivers licenses from people in the United States and Canada. Nexus also listed more than 10 million identification cards, over three million travel documents or international IDs, and at least 579,000 medical cards. A blank search in Nexus returned approximately 11.5 million pages of results, roughly 15 results per page, and the number of drivers license records rose by nearly 400,000 in a single 24-hour span.
What the dataset contains — images, timestamps, and evidence tying records to in‑person interactions
Many records in Nexus include multiple image files for the same license: front and back scans, and in some cases infrared and ultraviolet versions. Several of those files carry date-and-time stamps appended to their filenames. The KrebsOnSecurity author found his own Virginia license among the listings; the timestamp corresponded to a June 2025 flight he took. His mother's license appeared with timestamps only seconds apart; both said they handed their licenses to a Hertz rental counter representative at roughly the same time.
Researchers who helped with the reporting confirmed nine people whose licenses appeared in Nexus; timestamps for those records matched travel or rental dates they reported. From shared car rental records, the timestamps appear to be set to Greenwich Mean Time (GMT), although the timezone was not definitively identified. Not every affected person remembered showing a driver’s license at airport security; some had shown passports instead. Several people who had matching Nexus records said they had rented cars from Hertz around the timestamped dates.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildConnections to idscan.net, Planet13, Hertz, and the scan technology
The Nexus operators claimed the images stem from a breach at "a major identity verification company" whose customers include multiple Fortune 500 firms. KrebsOnSecurity reporting ties that description to idscan.net, a New Orleans–based identity verification provider. idscan.net in 2022 announced an exclusive identity verification agreement with the Planet13 chain of marijuana dispensaries. The idscan.net "trust" page lists customers including Hertz, Target, Fedex, Motorola Solutions, Jack Henry, and Caesars Entertainment, and company documentation notes its technology can capture infrared and ultraviolet scans — the same kinds of images present in many Nexus records.
idscan.net told KrebsOnSecurity it was investigating the matter but provided no substantive public statement. Jillian Kossman, identified as a marketing and operations leader at idscan.net, wrote: "At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation."
High-profile records, researcher observations, and immediate reactions
Nexus’s index reportedly included drivers license images for several high-ranking U.S. government officials, including a record for U.S. Defense Secretary Pete Hegseth and a record for an assistant director of the FBI. KrebsOnSecurity did not find a drivers license for FBI Director Kash Patel in Nexus.
Security researcher Zach Edwards — cited in the reporting and whose DecryptAds service helps people understand advertising tracking — found his own license in Nexus; the timestamp matched a mid‑2026 trip to Las Vegas for the DEFCON conference. Edwards told KrebsOnSecurity he had handed over his license at three places that day: a TSA checkpoint, a Planet13 dispensary, and his hotel (the Aria); he said only the dispensary for sure scanned his ID.
Larry Baldwin, principal intelligence researcher at Cybera, highlighted the privacy and safety consequences: state-issued drivers licenses are commonly used to open credit and to match identities, and exposed license images can endanger people who cannot easily change their appearance — such as domestic violence survivors or protected witnesses.
FBI inquiry and the current state of the Nexus service
KrebsOnSecurity reported that the FBI’s New Orleans field office opened an official investigation into an apparent breach involving idscan.net. The author was added to a conference call that included a half-dozen FBI agents and senior leaders from the agency’s cyber division; the FBI stated the New Orleans field office had opened the inquiry earlier that day.
Shortly after the initial report, Nexus’s darkweb site went offline; its login page was replaced with a plain-text message stating, "This service is no longer available." The disappearance of the site came after the FBI inquiry and the publication of the reporting.
What this means for consumers, identity verification vendors, and law enforcement
- Consumers: Individuals whose license images appear in Nexus face risks tied to identity theft and fraud because many Nexus records include high-resolution scans and multiple spectral images used for verification.
- Identity verification vendors and commercial customers (idscan.net, Planet13, Hertz, and corporate customers listed on idscan.net): Organizations that collect or rely on scanned IDs should expect scrutiny; idscan.net has acknowledged investigating and its own materials indicate it scans infrared and ultraviolet images at scale (more than 21 million verifications monthly, the company says, at over 20,000 locations).
- Law enforcement and investigators: The FBI New Orleans field office has opened an inquiry; the presence of high-profile officials’ licenses and a large, growing dataset make criminal and national-security implications part of the investigation already under way.
The basic facts are stark: a newly advertised Nexus service claimed to be selling more than 153 million drivers licenses and supporting files; many of those files carry timestamps and images consistent with in-person scanning; idscan.net — a Louisiana-based identity verification company with documented relationships to Planet13 and many corporate customers — is the focal point of the FBI’s newly opened New Orleans investigation. Nexus later went offline, and idscan.net says it is investigating. The legal and technical inquiries now underway will determine how these images were collected and who ultimately had access to them.
Source: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/
