Massive Dark Web Breach Exposes Over 153 Million Driver’s License Scans
A dark web marketplace, Nexus, has reportedly offered for sale digital scans of over 153 million U.S. and Canadian driver’s licenses, along with 10 million ID cards, 3 million travel documents, and hundreds of thousands of medical cards. The service, which claimed to obtain the data through a live breach at a major identity verification company, advertised searchable scans including front/back images and infrared/ultraviolet scans making them highly valuable for identity theft.
Security researcher Brian Krebs confirmed the site’s existence after being alerted to it on a Russian cybercrime forum. His own driver’s license was offered as a free sample, and he verified at least nine leaked documents. The FBI has acknowledged investigating the incident but has not disclosed further details.
The breach highlights growing risks as businesses increasingly rely on third-party identity verification providers, many of which retain sensitive biometric and ID data. Unlike passwords or credit card numbers, government-issued IDs cannot be easily replaced, amplifying the long-term threat. Experts warn that such data could fuel fraudulent credit applications, targeted phishing, and account takeovers for years.
While Nexus has since gone offline, similar dark web services are expected to emerge. The incident follows other recent breaches, including:
- A MOVEit file-transfer vulnerability exploited by the Clop ransomware group, exposing 6 million Louisiana driver’s license records.
- A third-party vendor breach affecting 3 million hunting/fishing license customers, compromising driver’s licenses and passport numbers.
The scale of the Nexus breach if verified would rank among the largest single leaks of government ID data, underscoring the vulnerabilities of centralized identity verification systems. Authorities continue to monitor dark web activity linked to the incident.
Source: https://time.com/article/2026/09/03/fbi-probes-reported-dark-web-drivers-license-breach/
Nexus cybersecurity rating report: https://www.rankiteo.com/company/nexus
"id": "NEX1788567870",
"linkid": "nexus",
"type": "Breach",
"date": "6/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '153 million+ individuals (U.S. '
'and Canadian)',
'industry': 'Identity verification',
'name': 'Major identity verification company (unnamed)',
'type': 'Third-party vendor'},
{'customers_affected': '6 million individuals',
'industry': 'Public sector',
'location': 'Louisiana, USA',
'name': 'Louisiana (MOVEit breach)',
'type': 'Government'},
{'customers_affected': '3 million individuals',
'industry': 'Licensing services',
'name': 'Third-party vendor (hunting/fishing license '
'breach)',
'type': 'Third-party vendor'}],
'attack_vector': 'Third-party vendor breach',
'data_breach': {'data_exfiltration': 'Yes',
'file_types_exposed': ['Scans (front/back images)',
'Infrared/ultraviolet scans'],
'number_of_records_exposed': '166+ million (153M driver’s '
'licenses + 10M ID cards + 3M '
'travel docs + hundreds of '
'thousands medical cards)',
'personally_identifiable_information': 'Yes (full names, '
'addresses, biometric '
'data)',
'sensitivity_of_data': 'High (biometric data, '
'infrared/ultraviolet scans, PII)',
'type_of_data_compromised': ['Driver’s licenses',
'ID cards',
'Travel documents',
'Medical cards']},
'description': 'A dark web marketplace, Nexus, has reportedly offered for '
'sale digital scans of over 153 million U.S. and Canadian '
'driver’s licenses, along with 10 million ID cards, 3 million '
'travel documents, and hundreds of thousands of medical cards. '
'The service claimed to obtain the data through a live breach '
'at a major identity verification company, advertising '
'searchable scans including front/back images and '
'infrared/ultraviolet scans, making them highly valuable for '
'identity theft.',
'impact': {'brand_reputation_impact': 'High',
'data_compromised': '153 million driver’s licenses, 10 million ID '
'cards, 3 million travel documents, hundreds '
'of thousands of medical cards',
'identity_theft_risk': 'High'},
'initial_access_broker': {'data_sold_on_dark_web': 'Yes (Nexus marketplace)'},
'investigation_status': 'Ongoing (FBI)',
'lessons_learned': 'Growing risks of third-party identity verification '
'providers retaining sensitive biometric and ID data; '
'government-issued IDs cannot be easily replaced, '
'amplifying long-term threats.',
'motivation': 'Financial gain, identity theft',
'post_incident_analysis': {'root_causes': 'Third-party vendor breach at a '
'major identity verification '
'company'},
'recommendations': 'Enhanced monitoring of third-party vendors, stricter data '
'retention policies, and improved identity verification '
'security measures.',
'references': [{'source': 'Brian Krebs (Security Researcher)'},
{'source': 'FBI'}],
'response': {'law_enforcement_notified': 'FBI investigating'},
'threat_actor': 'Nexus (dark web marketplace)',
'title': 'Massive Dark Web Breach Exposes Over 153 Million Driver’s License '
'Scans',
'type': 'Data Breach'}