Federal investigators are looking into how a huge collection of scanned identification documents ended up being offered to criminals online. The collection contains images belonging to people across North America, with driver’s licenses making up most of the records.
The website offering the material called itself Nexus. Its operators claimed to possess over 153 million driver’s license records, along with millions of other forms of identification. Those included more than 10 million ID cards, over three million travel or international documents and at least 579,000 medical cards. The records were mostly connected to Americans, although Canadian documents were included too.
Some prominent government officials were caught up in the collection. One record belonged to U.S. Defense Secretary Pete Hegseth, while information connected to an FBI assistant director was also reportedly available.
Cybersecurity journalist Brian Krebs first learned about the operation after a source contacted him on Aug. 31. An advertisement for the service had appeared on Exploit, a Russian cybercrime forum. What made the discovery especially unusual for Krebs was that the seller had chosen his own Virginia license as a sample to show potential customers.
Krebs examined the service to see whether its claims about the amount of data seemed realistic. An empty database search produced around 11.5 million pages of results, with about 15 entries appearing on each page. A separate search of Canadian licenses produced approximately 1.1 million results. Ontario accounted for 473,673 of those records.
The collection appeared to be changing as Krebs investigated it. Nearly 400,000 additional license records appeared within about 24 hours. The people operating Nexus claimed they had been collecting new material for more than a year from a large business that handles identity checks.
There were details inside the files that offered clues about their origin. Krebs’ record contained several versions of his license, including the front and back captured through regular, infrared and ultraviolet imaging. Dates and times were included with the images. In his case, they pointed to a day in June 2025 when he traveled to the Midwest for a family funeral.
Krebs then received permission from friends and relatives to see whether their information was there too. Nine people he checked had licenses in the collection. Their image dates all fell on or close to days when those people had been traveling.
That pattern first made airports seem like a possible source. It did not explain every case, though. Several people said they had not presented a state license while going through airport security, and one person had not recently flown at all. That person was using a Hertz rental car around the time connected to the license images.
Krebs had also used a passport rather than his license while passing through airport security during his June trip. Later that day, he and his mother presented their licenses while picking up a rental vehicle. Both licenses were later located in the stolen collection, and the recorded times on the two sets of images were separated by only a few seconds.
Security researcher Zach Edwards provided a different clue. His license appeared with a date that fell during a Las Vegas trip for the DEFCON security conference. Edwards remembered presenting his identification at several locations, including airport security, a hotel and a marijuana dispensary. He knew that the dispensary had run the card through an electronic scanning system.
The dispensary was Planet13. IDScan.net, a New Orleans company that provides technology for checking identification, had previously announced that its equipment would be used by the dispensary business. The verification company also works with a large number of other dispensaries across the country.
The way some Nexus images were created raised more questions about a possible connection to that company. IDScan’s technology is capable of examining identification with ultraviolet and infrared methods, and those types of images were present in some of the stolen records. The company reports that its equipment is installed in thousands of locations and processes millions of identity checks each month.
Krebs contacted IDScan.net while researching the issue. The company said it had started its own investigation but did not immediately provide detailed answers about what had occurred. Jillian Kossman, who works in marketing and operations for the company, told Krebs that information he had shared was helping with that investigation.
The matter also reached federal law enforcement. Krebs participated in a call with several FBI officials, including members of the agency’s cyber division. He was told that investigators in the FBI’s New Orleans office had begun examining a possible security compromise involving IDScan.net.
Larry Baldwin, a cybersecurity researcher with Cybera, also discovered his license among the records. The date connected to his images matched a recent vacation when he had rented a vehicle from Hertz. His record contained images of both sides of the license.
Baldwin said having copies of actual licenses could give criminals useful material for identity fraud because the documents are commonly accepted as proof of identity. He also raised concerns about people who have serious reasons for keeping their whereabouts private. Domestic violence survivors and people living under new identities through the federal witness protection program could face especially serious privacy risks if their information were included.
The website did not stay online for long after Krebs reported what he had found. Its normal login screen disappeared and was replaced by a brief notice saying the service was no longer available. By then, the FBI had begun its inquiry and IDScan.net was conducting its own investigation into the apparent exposure.
This image is the property of The New Dispatch LLC and is not licenseable for external use without explicit written permission.
