Nexus sells 153 million license scans that Krebs traces to a Louisiana IDV vendor
Every company that outsourced KYC document capture now owns an exposure it never inventoried, because the images being sold appear to come from the verifier rather than from any of its customers. The FBI opened the file in New Orleans.
The Watch · Security desk
What happened
- A service called Nexus, advertised on Aug. 31 by a new user on the Russian forum Exploit, lists more than 153 million US and Canadian drivers licenses, 10 million ID cards, three million travel documents and 579,000 medical cards.
- KrebsOnSecurity says interviews with people in the index point to images collected by a widely used identity verification company based in Louisiana, while the sellers claim an active breach at a firm with Fortune 500 customers.
- The FBI's New Orleans field office opened an official inquiry into the source of the images on the day the report published.
- Nine of the more than a dozen friends and family Krebs searched for were in the index, and every one of them confirmed traveling on or very close to the date stamped on their scan.
- The free sample in the sales thread was the author's own Virginia licence, timestamped to a June 2025 flight he took to the midwest for a family funeral.
Why it matters
- Who's exposed exposure If the breach is at the verifier, the customer notification and the trust damage land on its clients, none of whom hold the logs from the system that captured the images.
- What's now possible capability Preview-before-purchase with the customer photo attached lets a fraudster confirm a named target is in stock before spending money, which is cheaper than forging a document and waiting to see if it passes.
- Who has to decide decision Retention becomes a procurement question rather than a security one: whether a verification supplier keeps the raw infrared and ultraviolet frames after a check clears, and who is contractually obliged to disclose when that store is breached.
- What it limits constraint A licence scan cannot be rotated like a password, so remediation for the 153 million is limited to reissue and to raising the bar on document-only onboarding.
Next story · Security · 5d ago
Contractor's missed PeopleSoft patch let attackers into FBI employee dataConfirmed2 publishers
The six image files behind each record are the useful evidence. The entry for Krebs holds three front-and-back pairs: a plain scan, an infrared version and an ultraviolet version, with a date and time appended to each file [9]. Infrared and ultraviolet passes are how a reader inspects the security features printed into a licence. That points at capture hardware standing at a counter, inside a verification workflow, rather than at a copied DMV table.
The collection points do not resolve to one venue. No passports appear in the set, which is what ended the airport theory [10]. One person found in the index had not flown recently and had a Hertz rental running for several months around the date of their timestamp [11]. The index also carries marijuana dispensary cards [12] and records tagged "CDL" or "CAC", the second of which may mean Common Access Cards [13]. A rental counter and a dispensary have little in common on the surface, but both could plausibly route their identity checks through the same verification supplier.
The size claim holds up on arithmetic. A blank search returns roughly 11.5 million pages at about 15 results per page [14], which lands near 172 million indexed documents and puts the 170 million figure in the sales thread inside the range rather than above it [24]. Canada supplies about 1.1 million of the licences, under one percent of the total, with Ontario the largest single concentration at 473,673 records [19][25]. Listings grew by nearly 400,000 licences in 24 hours [15]. At that rate, 153 million licences take about 383 days to pile up [26], which sits close to the "over a year" of continuous exfiltration the sellers advertise [16]. The numbers are consistent with each other, but consistency is not the same as corroboration.
There is no CVE here and nothing to patch. The exposure sits with every firm that moved document capture to a supplier and never wrote down where the raw frames went afterward. The questions are which supplier performs the capture, whether it keeps the infrared and ultraviolet frames after the check passes, for how long, and whether the contract obliges it to notify you when its own image store is the thing that leaks. Krebs has not named the Louisiana company [5], so procurement records are the only place a buyer can look. The Bureau opening this out of New Orleans is at least consistent with a vendor sitting in Louisiana [23].
The shop lets a buyer preview a record with pertinent fields redacted and displays the customer photo where it has one [20]. The workflow is built to confirm a named target is in stock before the buyer spends money, which functions less like a data dump and more like a fraud pipeline.
What to watch
- Whether the Louisiana identity verification company is named, and whether it notifies its corporate customers or the issuing states first.
- Whether the daily add rate holds now that the FBI inquiry is public, which would show the exfiltration path is still open.
- Whether any record tagged "CAC" is confirmed as a Common Access Card, which would pull federal credential issuers into the inquiry.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption65
- Hype gap+15
- Incentives55
- Confidence60
Perspective Coverage
7 publishers- Builder
- Builder 23%
- Operator
- Operator 49%
- Investor
- Investor 28%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Based on interviews with individuals whose licenses are available for purchase on the service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana.
- [2]
A new identity theft service launched on the dark web is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada.
- [3]
The New Orleans field office of the FBI launched an official inquiry into the source of the images on the day of the report.
- [4]
The service, dubbed Nexus, claims more than 153 million drivers licenses for people in the US and Canada, more than 10 million identification cards, more than three million travel documents and/or international IDs, and at least 579,000 medical cards.
- [5]
The report does not name the Louisiana-based identity verification company whose images the service appears to be siphoning.
- [6]
On Monday, Aug. 31, a source alerted KrebsOnSecurity to a service advertised by a new user on the Russian cybercrime forum Exploit, offering access to digital scans of identity documents on more than 170 million people in North America.
- [7]
The proprietor of the service offered the Virginia drivers license of KrebsOnSecurity's author as a free sample in the initial sales thread on Exploit.
- [8]
The people behind Nexus claim the license images come from an active breach at "a major identity verification company" whose customers include multiple Fortune 500 companies.
- [9]
The record featuring the author's drivers license includes six image files: three pairs of photos of the license front and back, comprising a basic image scan plus infrared and ultraviolet versions of the same images, with a date and timestamp appended to each image file.
- [10]
An initial theory that the data came from airports was discarded because there were no passports in the data set, and only some of the people who helped with the research had shown a drivers license at the airport on their travel date.
- [11]
One person whose license was in Nexus had not flown recently but was renting a car from Hertz for several months around the date of their timestamp.
- [12]
The identity records in Nexus include marijuana dispensary cards as well as drivers licenses.
- [13]
Some Nexus records list their source as "CDL," presumably commercial drivers license; others carry the source notation "CAC," which may refer to Common Access Cards, government issued identity cards granting physical access to government buildings and secure rooms.
- [14]
Running a blank search in Nexus with no parameters returns approximately 11.5 million pages of results, with roughly 15 results displayed per page.
- [15]
Over a 24-hour period the number of drivers license records listed as available in Nexus increased by nearly 400,000.
- [16]
Nexus stated in its introductory post: "We have been continuously exfiltrating new data for over a year into our private database."
- [17]
KrebsOnSecurity asked more than a dozen friends and family members for permission to search for their licenses in the service; nine were found, and each of those people confirmed having traveled on or very close to the dates in the timestamps attached to their images.
- [18]
The timezone of the image timestamps appears to be Greenwich Mean Time, based on car rental records shared by several people who helped with the research.
- [19]
Searching for just Canadian drivers licenses returns approximately 1.1 million results, with the largest concentration from Ontario at 473,673 records.
- [20]
Nexus says records are available to preview before purchase with pertinent information redacted, and that customer photos are displayed if available.
- [21]
The timestamp on the author's license scan corresponds to a date in June 2025 when he took a flight to the midwest United States to attend a family funeral.
- [22]
Two of the people who agreed to help with the research are federal employees who said they showed other forms of government identification when passing through airport security.
- [23]
The inquiry being opened by the FBI's New Orleans field office is geographically consistent with the account of a Louisiana-based identity verification vendor as the source.
- [24]
The blank-search page count implies roughly 172 million indexed documents, which is above the 170 million figure advertised in the Exploit sales thread.
- [25]
Canadian licences are about 0.7 percent of the 153 million total, and Ontario is about 43 percent of the Canadian records.
- [26]
At a rate of 400,000 licence records per day, accumulating 153 million licences would take about 383 days, roughly 12.6 months.
Sources
7 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comIDScan sued over alleged data breach affecting 153 million drivers
1 article · September 4, 2026
- cyberinsider.com153 million driver’s licenses exposed in suspected IDScan breach
1 article · September 2, 2026
- infosecurity-magazine.comFBI Probes Possible Breach of 153 Million Driver’s Licenses
2 articles · September 7, 2026
- krebsonsecurity.comFBI Probes Service Selling 153M+ Drivers Licenses
2 articles · September 2, 2026
- malwarebytes.comDark web site puts 153 million driver’s licenses and millions more IDs up for sale
1 article · September 2, 2026
- securityaffairs.comDark Web Service Nexus Sells 153M+ Driver’s Licenses
1 article · September 4, 2026
- securityweek.com153 Million Driver License Images Offered on Dark Web
1 article · September 3, 2026
Topics and entities
Topics
- Identity Verification
- Class action litigation
- Age Verification
- Dark web marketplaces
- Data Breaches