More than 170M ID scans for sale on dark web in breach allegedly traced to IDScan.net

A massive trove of scanned identity documents has been discovered for sale on a Russian cybercrime forum, exposing the biometrics and personal information of more than 170 million people in North America – primarily U.S. driver’s licenses.

Reported to KrebsOnSecurity, the identity theft service dubbed Nexus contains more than 153 million driver’s licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical cards, including cannabis dispensary cards – apparently sourcing the documents from the database of New Orleans-based identity verification provider IDScan.net.

Krebs quotes an introductory note Nexus posted on Russian forum Exploit, by way of advertising: “We have been continuously exfiltrating new data for over a year into our private database,” the service says. “Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.”

Rental car company appears to be major source for stolen IDs

Brian Krebs, who runs the site, says his own driver’s license was among those for sale on Nexus, with alarming personal details. “The record that features my drivers license includes six image files – three pairs of photos of the license’s front and back – a basic image scan – as well as infrared and ultraviolet versions of the same images. A date and timestamp is appended to each image file, and the timestamp on my license scan corresponds to a date in June 2025 when I took a flight to the midwest United States to attend a family funeral.”

Krebs’ investigative work leads him to believe the theft occurred when travelers used their driver’s licenses to rent a car through the company Hertz; however, that has not yet been confirmed. Outlets of the Planet 13 cannabis dispensary chain may also have been the source for some of the scanned documents. Krebs notes that, in 2022, Planet 13 signed an exclusive identity verification agreement with IDScan.net. Hertz is also listed among the provider’s customers.

IDScan has not yet offered formal comment on the matter. It may be saving its comments for the New Orleans field office of the Federal Bureau of Investigation (FBI), which has launched an official inquiry into the breach.

Age assurance not the right punching bag for privacy advocates

The Nexus service has now been taken offline. But the damage could prove to be a setback for digital identity advocates, giving ammunition to those who say third-party ID verification providers can’t be trusted to protect user data.

To wit, this comment from MalwareBytes: “Age verification has become a common justification for asking people to upload an ID, take a selfie, or submit both to a third-party identity verification provider. We have previously warned about the privacy and security trade-offs in age verification systems, particularly those that require people to submit copies of government-issued ID. Such systems can turn a request to access a website into a decision to share an enduring identity document with a company the user may never have heard of.”

Ironically, however, digital identity models may have prevented this kind of breach. The ID scans for sale on Nexus originated as physical cards handed over to human clerks, who then scanned the documents. This period in which a license holder loses control of their data is exactly what mobile drivers licenses (mDL), digital credentials, cryptographic zero knowledge proofs and selective disclosure mechanisms are designed to prevent.

Moreover, the breach indirectly illustrates the advantages of facial age estimation and other privacy-preserving biometric processes that do not rely on government ID. MalwareBytes concedes as much, in saying that “this is why ‘we only need to verify your age’ should not automatically mean ‘please upload your driver’s license’ or another form of ID” – a statement most age assurance providers would heartily agree with.

Critics appear caught in a logic loop, in which age assurance – currently in the headlines worldwide – always circles back to identity verification, which is not the same process. Indeed, while cannabis dispensaries would have required ID for proof of age, Hertz’ collection of data would be categorized as a general identity verification use case, not age assurance.

Digital security still begins with physical credential

Nonetheless, a breach is a breach, and every stolen scan of a physical identity document is a potential wellspring for fake and synthetic IDs. In a recent article for Biometric Update, Steve Yonkers, director of business development for Veridos America, underscores the continuing importance of physical document security, arguing that it remains “a critical line of defense against fraud.”

“Far from becoming obsolete, physical credentials remain indispensable components of modern identity infrastructure and the foundation upon which broader digital identity ecosystems are built. Investing in stronger physical credential security today is therefore not simply a technology upgrade; it is a long-term investment in public trust, fraud prevention, and the resilience of the broader identity ecosystem that citizens and organizations rely upon every day.”

“As states continue to modernize credential ecosystems, the success of these programs will depend on balancing physical security, digital trust, and long-term infrastructure resilience.”

Article Topics

data protection  |  digital ID  |  driver's license  |  identity document  |  IDScan.net  |  United States