In short: A darknet service called Nexus emerged at the end of August 2026 on a Russian-language hacking forum, offering scans of 153 million driver's licences from the US and Canada, alongside millions of passports, ID cards, and medical records. Investigative journalist Brian Krebs traced the breach to IDScan.net — a Louisiana-based identity verification firm processing over 21 million verifications a month. The FBI opened a formal investigation on September 1, 2026.
What happened
On August 31, 2026, a service called Nexus was advertised on the Russian cybercriminal forum Exploit. For a small fee, anyone could obtain a scan of the driver's licence or passport of virtually any US or Canadian resident. The database contained:
- over 153 million driver's licences from the US and Canada;
- more than 10 million ID cards;
- over 3 million passports;
- at least 579,000 medical records.
The service was taken offline after widespread media coverage, but by then the data had already circulated among buyers. For practical advice on minimising your exposure to breaches like this, see our cybersecurity blog.
Where did the data come from
Security journalist Brian Krebs found a scan of his own driver's licence in the Nexus database. Examining the metadata, he determined the document had been scanned the exact day he rented a car from Hertz. Researcher Zack Edwards similarly found his licence in the database, matched to a visit to the Planet 13 cannabis store in Las Vegas.
This trail led to IDScan.net, a New Orleans, Louisiana company that builds automated identity verification systems. The platform processes more than 21 million verifications per month across 20,000+ locations in North America. Clients include Hertz, Target, FedEx, Motorola Solutions, and Caesars Entertainment.
IDScan.net confirmed it was conducting an internal investigation but declined to provide detailed statements. The FBI's New Orleans field office opened a formal investigation on September 1, 2026. The database was being updated at approximately 400,000–500,000 records per day, meaning much of the data was added the same day documents were scanned.
Why an identity document leak is dangerous
A driver's licence is among the most valuable documents for criminals. A scan enables:
- opening credit accounts or loans in another person's name;
- passing identity verification at banks or cryptocurrency exchanges;
- creating fraudulent accounts on any platform requiring KYC (Know Your Customer) checks;
- using photos to identify individuals via facial recognition systems.
The threat is particularly acute for people fleeing domestic violence or enrolled in witness protection programmes, who can be physically located using photos from the database. Read more about surveillance tools and how to protect against them in LiMP VPN's features section.
What this means for you personally
You cannot control how companies store your documents — especially when presenting ID is mandatory to access a service. But there are steps that reduce the consequences of a breach:
- Check your exposure. Have I Been Pwned (haveibeenpwned.com) shows whether your email appeared in known breaches. Follow news about specific services you've used.
- Enable transaction alerts. SMS or push notifications from your bank let you respond immediately to any fraudulent attempt.
- Use unique passwords everywhere. A document scan from one service shouldn't unlock your other accounts.
- Encrypt your traffic. LiMP VPN secures your connection and shields data in transit — especially important on public Wi-Fi where interception is most likely.
Digital privacy is built in layers: strong unique passwords, two-factor authentication, encrypted network connections. Each layer narrows what attackers can do — even when a service you had no choice but to trust suffers a breach.
Sources
- 153M Driver's Licences for Sale, Including US Defense Secretary's ID — CNews, September 3, 2026
- Nexus: 153M Driver's Licences in Darknet, FBI Hunts IDScan.net Source — tproger.ru
- Russian Hacking Forum Sold Half of US Residents' Driver's Licences — The Moscow Times