153 Million License Scans Are for Sale, and the Sellers Say They Still Have Access

The last time you handed your driver's license to a rental car counter, or a hotel front desk, or the guy working the door at a dispensary, somebody ran it through a scanner. You probably never learned the name of the company behind that scanner. You never signed up with them, either.

A dark web store called Nexus is selling those scans. Its catalog claims 153 million driver's licenses covering people in the United States and Canada. Brian Krebs broke the story Wednesday at Krebs on Security, and he verified it against himself. He found a record holding six image files of his own license, timestamped to a trip he took in June 2025. Other people he reached out to found their own records too.

The tap is still open

Most breach stories are about the past. A company loses a database in 2019, the file circulates for years, you change a password and move on. This one is live. The Nexus operator told Krebs the crew has "been continuously exfiltrating new data for over a year into our private database," and the site's own counter backs that up. The driver's license total climbed by roughly 400,000 in 24 hours.

The catalog goes well past licenses. Krebs counted more than 10 million identification cards, over 3 million travel documents and international IDs, roughly 579,000 medical cards, and a pile of marijuana dispensary cards. A blank search on the site returns something like 11.5 million pages of results at about 15 records per page. Buyers get to preview a record with the important parts blacked out before they pay.

Where the scans came from

Krebs traced the images to IDScan.net, a New Orleans company that sells identity verification hardware and software. His wording is that the scans appear to be siphoned from it. When he asked, IDScan.net told him only that it could not share more at this point, and that the information he had given was useful to its own investigation.

The company's trust page lists Hertz, Target, FedEx, Motorola Solutions, Jack Henry and Caesars Entertainment as customers. Krebs also ties the Planet13 dispensary chain's door scanners to the pile. You never picked IDScan.net. You picked a rental car, a hotel room, a casino floor, and the scanner was already sitting on the counter.

What the FBI actually said

Krebs was pulled onto a conference call Wednesday afternoon with about half a dozen FBI agents, including senior people from the bureau's cyber division. They told him the New Orleans field office had opened an official investigation that day into an apparent breach involving IDScan.net.

That is a starting point. Nobody has been charged, no findings have been published, and the FBI has not said IDScan.net is at fault. It opened the case the same day the story ran.

You can't change a license number

A leaked password takes ten seconds to fix. A leaked license scan is a photograph of a document you will carry for years, with your face, your address, your birthday and your license number all sitting in the same frame. You cannot rotate it the way you rotate a password.

Freezing your credit is free, you do it once at each of the three big bureaus, and it blunts the thing this data is mostly good for, which is opening accounts in your name. Past that, treat every "verify your identity by uploading a photo of your ID" flow as a weaker check than it was last week. The people running those scams now have 153 million real ones to work from.

Krebs went looking and found six photos of his own license, timestamped to a trip he took last June. The counter on the site is still going up.