Think about how often you hand someone your driver’s license without giving it much thought. You rent a car, check into a business or go somewhere that needs to verify your age. Someone scans your ID, hands it back and you move on.
A dark web service called Nexus claimed to have collected more than 153 million driver’s license records from people in the United States and Canada. It also claimed to have more than 10 million identification cards, over 3 million travel documents or international IDs and at least 579,000 medical cards. That’s a staggering amount of identity information.
There is an important caveat, though. The 153 million figure comes from Nexus itself. It has not been confirmed as the number of unique people affected. Some records also contained multiple images of the same license. Still, researchers found enough real driver’s licenses in the database to get the FBI’s attention.
NEW! Join our upcoming CyberGuy LIVE class: Get Better Healthcare With AI
In this free live online class, Kurt “CyberGuy” Knutsson will show you five practical ways AI can help you take a more active role in your healthcare. You’ll learn how to organize your health history, remember important appointment details, understand complicated medical information, research prescriptions and prepare questions for your next doctor’s visit. No technical experience is needed.
Register for free now at CyberGuyLive.com
INSURANCE BREACH EXPOSES 7M DRIVER’S LICENSES
KrebsOnSecurity reported that Nexus appeared on the Russian-language cybercrime forum Exploit on Aug. 31. The service advertised access to identity documents covering more than 170 million people in North America. Driver’s licenses made up the biggest category.
Nexus claimed more than 153 million driver’s license records. It also advertised millions of other identity documents and hundreds of thousands of medical cards. Krebs tested the service by running a blank search. That returned roughly 11.5 million pages of results with about 15 records per page.
That does not prove there were 153 million different people in the database. However, it does support the possibility that the collection was enormous. More concerning, the driver’s license total increased by nearly 400,000 records in about 24 hours while Krebs was examining the service.
The people running Nexus claimed they had been continuously taking new data for more than a year. Investigators have not independently verified that claim.
The timestamps attached to some of the images helped researchers begin tracing where the records might have originated. Cybersecurity journalist Brian Krebs discovered his own Virginia driver’s license being offered as a free sample by the people promoting Nexus.
His record contained six image files. Those included images of the front and back of his license, along with infrared and ultraviolet versions. Krebs then asked friends and family members for permission to search for their licenses. Nine people whose licenses appeared in Nexus said the timestamps closely matched dates when they had traveled or presented identification. That led investigators away from the idea that airport security alone might explain the records.
For example, Krebs reported that he had used his passport at airport security during one trip. Later that day, he and his mother handed their driver’s licenses to a Hertz rental car representative. Their driver’s license scans in Nexus carried timestamps only seconds apart.
Security researcher Zach Edwards found his license in Nexus too. His timestamp lined up with a trip to Las Vegas. Edwards said he had presented his license in several places during the trip. However, he specifically remembered having it scanned at Planet 13, a marijuana dispensary.
The Planet 13 connection pointed researchers toward Louisiana-based identity verification company IDScan.net, which announced a partnership with the dispensary in 2022. Its scanners can capture IDs using ultraviolet, infrared and white light, similar to the additional scans found in some Nexus records.
IDScan.net has since acknowledged a security incident. The company says an unauthorized third party may have accessed or copied customer information stored in accounts on its cloud. That information may include full names and driver’s license or other government-issued identification numbers.
IDScan.net says it is notifying potentially affected people and offering free credit monitoring. However, the company has not confirmed that the Nexus collection came from its systems or that the 153 million records represent 153 million unique people.
IDENTITY THEFT RARELY ANNOUNCES ITSELF: 6 SIGNS YOU MISSED
The FBI has now confirmed that it is examining what happened. In a statement to Reuters on Sept. 2, the bureau said it was “looking into the incident” but could not provide more information because of the ongoing investigation.
Reuters reported that the breach, if confirmed at the reported scale, could rank among the largest exposures of government-issued identity documents in North America.
Shortly after KrebsOnSecurity published its investigation, the Nexus dark web site disappeared. Its login page was replaced with a message saying the service was no longer available. That does not mean the stolen records disappeared with it. Anyone who purchased or downloaded information before the site vanished could potentially retain copies.
Your driver’s license holds information criminals can use to make impersonation attempts much more convincing. Depending on the state, it may include your full name, address, date of birth, license number, photograph and signature.
A high-quality image of the front and back can also give a criminal something physical to present during an identity check. That can become especially concerning when businesses use driver’s licenses to verify customers remotely or in person.
A stolen card number can usually be canceled. Your name, photograph and other identity information are much harder to replace.
You cannot pull back a driver’s license scan that may already have leaked, but you can make stolen identity information harder to use and watch for warning signs.
A credit freeze can make it much harder for someone to open a new credit account using your identity. The Federal Trade Commission says freezes are free. They also do not affect your credit score and remain in place until you lift them. To fully freeze your credit, contact Equifax, Experian and TransUnion separately .
A freeze primarily protects against new credit accounts. It will not stop someone from misusing an existing bank account or another service that does not check your credit. The FTC recommends credit freezes as one of the strongest protections against new-account identity theft.
Look through your credit reports for accounts, inquiries or personal information you do not recognize. An unfamiliar account can be an early sign that someone is using your identity.
Do not assume one clean check means you’re finished. Stolen information can sit unused for months before a criminal tries it. The FTC recommends reviewing your credit reports regularly for accounts you do not recognize.
A credit freeze cannot stop every form of identity fraud. Turn on transaction alerts through your bank and credit card providers. Also watch for password changes, new devices and changes to your contact information. Check your statements instead of relying only on alerts.
Your primary email account can become a gateway to everything else. Use a strong, unique password, store it in a trusted password manager and enable multifactor authentication when available.
Protect your mobile account too. Ask your carrier whether you can add an account PIN or stronger protection against unauthorized number transfers. Also, treat unexpected calls differently when the caller already knows information about you.
Knowing your address or driver’s license details does not prove someone is legitimate. That information could have come from stolen records.
Even with good security habits, identity theft can still happen. Your Social Security number, financial information or other personal data may already be exposed without you knowing it. An identity theft protection service can add another layer of monitoring.
Depending on the service and plan, protection may include credit and financial account monitoring, alerts when personal information appears in known breaches or risky online locations and access to specialists who can help with recovery if fraud occurs. Some services also offer reimbursement or coverage for eligible identity theft losses.
Look closely at what each service monitors, how quickly it sends alerts and what recovery help is included.
See my tips and best picks on Best Identity Theft Protection at CyberGuy.com.
If you discover someone using your identity, document what happened and start the recovery process quickly. The FTC recommends reporting identity theft through IdentityTheft.gov. The service creates a recovery plan based on the type of fraud involved.
If someone misuses your driver’s license, contact your state motor vehicle agency as well. Procedures for replacing a compromised license or changing a license number vary by state. Keep copies of reports, case numbers and correspondence. You may need them later when disputing fraudulent activity.
STOLEN IDS SOLD FOR ‘HAPPY MEAL’ PRICES FUEL BILLIONS IN US BENEFIT FRAUD
What jumps out at me here goes beyond the massive 153 million figure. We hand over our driver’s licenses all the time, often without knowing who keeps the scan or how long they store it. If criminals get a copy, they may have another powerful piece of information to use for identity theft. While investigators work to determine where the Nexus records came from, protect what you can. Consider freezing your credit, keep an eye on your accounts and use identity theft monitoring if you want added protection. And the next time someone scans your license, ask what happens to that image after you leave.
After seeing how driver’s license scans can potentially end up in criminal hands, will you think twice before letting a business scan yours? Let us know by writing to us at Cyberguy.com
Sign up for my FREE CyberGuy Report
Copyright 2026 CyberGuy.com. All rights reserved.
