FBI Investigates Dark-Web Sale of 153 Million U.S. and Canadian Driver's Licenses Tied to IDScan Breach
A newly launched dark-web marketplace called “Nexus” began advertising digital scans of more than 153 million U.S. and Canadian driver’s licenses in late August, along with over 10 million ID cards, 3 million travel documents, and nearly 580,000 medical cards. Security journalist Brian Krebs traced the leaked material to idscan.net, a Louisiana-based identity-verification company whose technology is used by car rental firms, retailers, gun shops, cannabis dispensaries, and financial institutions across the United States. Several people who checked their own records, including federal employees, confirmed that timestamps on the leaked scans matched real transactions where they had shown ID, most commonly at Hertz rental counters.
The scale and apparent sensitivity of the exposure quickly drew law-enforcement attention. The FBI’s New Orleans field office opened a formal investigation into the suspected breach, a fact independently confirmed by Reuters, and the bureau later acknowledged the inquiry to BleepingComputer while declining further comment. According to reporting, records tied to senior U.S. officials, including the Secretary of Defense and an FBI assistant director, were reportedly found among the listings, though this could not be independently verified. The Nexus site itself went offline within days of the story breaking, though the underlying data is believed to remain in criminal hands.
IDScan has not issued a public statement and has not confirmed how many individuals were affected or the mechanism of the breach, though it has reportedly begun notifying some business customers. Multiple law firms have since opened investigations into potential class-action litigation, with lawsuits filed in Louisiana alleging IDScan failed to adequately protect data belonging to corporate clients such as Hertz. Given the scale of the exposure, legal observers expect additional suits, possible multidistrict litigation, and scrutiny from state attorneys general or federal regulators, echoing prior large-scale breach cases involving companies like Equifax and Marriott.