NEW ORLEANS — A dark-web identity market that advertised more than 153 million U.S. and Canadian driver’s license scans is now under an FBI inquiry that points at Louisiana identity-verification vendor IDScan.net, according to reporting from Brian Krebs at KrebsOnSecurity.

Krebs reported that a new Exploit forum seller launched Nexus around Aug. 31, 2026, offering searchable document scans. The stall advertised more than 153 million driver’s licenses, about 10 million other ID cards, more than 3 million travel or international IDs, and at least 579,000 medical cards. Krebs said a blank search returned roughly 11.5 million result pages at about 15 records per page, and that the driver’s license count jumped by nearly 400,000 in a day while he was looking.

The seller claimed the haul was coming from an active breach at “a major identity verification company,” and that it had been “continuously exfiltrating new data for over a year,” Krebs wrote. Those are the seller’s claims. Independent labs have not published a full, third-party inventory of the dump.

Krebs got pulled in because Nexus used his own Virginia license as a free sample. He then asked more than a dozen friends and family for permission to search. Nine matches lined up with travel or rental dates on or near the timestamps baked into the image filenames. Several of those timestamps, he reported, appear to be in GMT and line up with Hertz car rentals. In one case, his mother’s and his own license images were seconds apart — the same Hertz counter handoff.

Airports were a weaker fit. Krebs said he did not see passports in the set, and some people whose licenses showed up said they never handed a license to TSA that day. Security researcher Zach Edwards told Krebs his license timestamp matched a DEF CON trip to Las Vegas where the one place that definitely scanned his ID in a device was the Planet13 marijuana dispensary. In 2022, IDScan.net announced an exclusive identity-verification deal with Planet13’s dispensaries. The company says it handles ID checks for more than 1,000 dispensaries in 19 states.

IDScan.net’s own marketing, Krebs noted, says its gear reads infrared and ultraviolet security features — the same kind of multi-band scans Nexus was selling alongside ordinary photos — and that it runs more than 21 million verifications a month across more than 20,000 locations. The firm’s trust page has listed customers including Hertz, Target, FedEx, Motorola Solutions, Jack Henry, and Caesars Entertainment. Caesars later told Krebs it has not been an IDScan.net client and has not used VeriScan since February 2025, despite being listed on the site.

Reached by Krebs, IDScan.net marketing and operations leader Jillian Kossman said the company was investigating but would not share more: “At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation.”

Krebs wrote that he was put on a conference call with about a half-dozen FBI agents, including cyber-division leadership, and that agents said the New Orleans field office had opened an official investigation into an apparent breach involving IDScan.net. The bureau has not posted a matching public press release that we could find. Treat the FBI confirmation as Krebs’s contemporaneous account of that call, not as a published FBI statement.

Nexus did not stick around for the aftermath. In a Sept. 2 update, Krebs said the marketplace vanished from the dark web after his story published, replaced by a plain message: “This service is no longer available.”

There is no PCI-style rulebook for license scans the way there is for payment cards. Hertz counters, Target checkouts, dispensary booths, and hotel desks keep feeding the same few ID vendors. Those vendors become honeypots. When the dump lands, you cannot rotate a face and a state ID the way you rotate a password. Edwards told Krebs the episode should harden resistance to schemes that force people to hand over licenses “under the guise of protecting kids,” because the data keeps landing in third-party systems with thin oversight. Larry Baldwin of Cybera, who also found his Hertz rental scan in Nexus, told Krebs the same pile threatens people who cannot change how they look — including people fleeing abuse and, in the worst cases, people in witness protection.

IDScan.net has not published a consumer notice with a confirmed victim count. The FBI has said little in public beyond looking into it, per Krebs. Anyone who handed a license to a Hertz desk, a Planet13 counter, or another IDScan customer in the last year should assume the scan may have been copied until the company or the bureau says otherwise on the record.

Sources