A dark web service called Nexus went live this week selling digital scans of more than 153 million drivers licenses from people in the United States and Canada. Brian Krebs traced the images to IDScan.net, an identity verification company in Louisiana whose customers include Hertz, FedEx, Target and thousands of cannabis dispensaries. The operators of Nexus describe the source only as "a major identity verification company" and say the pipeline is still running: "We have been continuously exfiltrating new data for over a year into our private database." The FBI's New Orleans field office has opened an inquiry into where the images came from.
The duration is what should bother anyone running a data pipeline. The feed stayed live for more than a year. In the 24 hours around disclosure, Nexus added nearly 400,000 records, so fresh scans were still arriving while the breach was being written up. It appears no one inside the company noticed.
An identity verification vendor exists to take a government ID, check it, and return a yes or no. The whole job is careful handling of sensitive records. A company in exactly that business had copies of every scan leaving for more than a year, and that matters more to its customers than whatever route the attackers used to get in.
Nexus lets buyers preview records with "pertinent information redacted" and shows the customer's photo when one is attached. Krebs found the sitting Secretary of Defense's license listed for $100. The leak is not tied to a single customer: Krebs cross-referenced the dates people were added against their own calendars and matched them to IDs handed over at places like a dispensary, which is how the trail led back to IDScan rather than to one business.
Larry Baldwin, a security researcher at Cybera, laid out the downstream damage. A state drivers license is standard proof of identity when opening a new line of credit, so the scans feed straight into account fraud. The service also exposes people who do not want to be found and cannot change how they look well enough to fool current AI image matching: those fleeing domestic violence, and people given a new identity under federal witness protection. "Just when it seems like we're making some headway in improving authentication controls through drivers license verification systems, this happens and the very thing those improvements are dependent on are compromised," Baldwin said.
IDScan.net's Trust Center page, describing how it protects data and earns customer confidence, was still up days after the breach surfaced. The company claims compliance with GDPR, CCPA and the rest, and has written approvingly of age verification mandates including KOSA.
For anyone building or buying into this kind of system, Krebs's reporting does not pin down the breach technique. Every ID that passes through becomes a record, and every record is a standing target. The only scan that cannot leak is the one you did not keep.
Unlike a password, this data does not rotate. A leaked credential gets reset; the face and the license number on these scans stay valid for years, which is why 153 million of them are worth standing up a storefront to sell.
Top comments (0)