153 Million U.S. and Canadian Drivers' Licenses Put Up...

[SUMMARY]A Russian darknet forum, Nexus, is selling more than 153 million U.S. and Canadian driver's license images and other forms of identification, apparently sourced from IDScan.net-related verification workflows. The FBI has launched an investigation.[/SUMMARY]

Incident Overview

In late August, a sales service named Nexus appeared on a Russian hacker forum, claiming to possess more than 170 million North American identity documents, including over 153 million U.S. and Canadian driver's licenses, 10 million ID card images, more than 3 million travel documents or other international identity documents, and 579,000 medical credential images. After the incident came to light, the FBI's New Orleans field office launched an investigation, and the Nexus site was soon taken offline.[1][4]

The data samples even included driver's license images belonging to a security researcher and an FBI assistant director.[1][4]

Technical Analysis

The leaked material included not only the front and back of driver's licenses, but also infrared and ultraviolet versions, along with dates and timestamps.[2][4]

Researchers further searched the Nexus site and found that most leaked driver's licenses came from U.S. residents, with about 1.1 million Canadian driver's licenses, and nearly 400,000 leaked driver's license images added in the past 24 hours.[1][2]

The investigation also indicated that some victims had shown their credentials at Hertz car rentals and at a legal cannabis retailer, and those businesses used an online verification solution provided by IDScan.net. Researchers therefore inferred that the leaked data may be related to stolen customer storage information from the backend of IDScan.net.[1][2]

Impact Scope

The scale of this incident has reached at least 153 million U.S. and Canadian driver's license images, plus 10 million ID cards, 3 million travel or international documents, and 579,000 medical credentials.[1][4]

Those affected include ordinary users, security researchers, and an FBI assistant director.[1][2]

Caesars Entertainment said last week that it stopped using the solution in early 2025.[4]

Protection Advice

IDScan.net has not publicly commented yet.[4]

Researchers and the FBI continue to investigate the case.[1][4]

5-Step Remediation Checklist

1. The Nexus site was shut down after media reports.
2. The FBI's New Orleans field office has launched an investigation.
3. KrebsOnSecurity reported that victims include an FBI assistant director and digital security researchers.
4. The site shows about 1.1 million Canadian driver's licenses.
5. In the past 24 hours, the site added nearly 400,000 leaked driver's license image records.

References

• ITNEWS ISC original report
• KrebsOnSecurity report