Future Technology153 million drivers licence scans are for sale on the dark web right now
Key takeaways
- 153 million US and Canadian drivers licence scans are listed for sale on a dark web marketplace called Nexus
- IDScan processes identity checks for Hertz, Target, FedEx, Motorola and cannabis dispensaries
- The breach went undetected for over a year, with nearly 400,000 new records exfiltrated in a single day
- Unlike passwords, a scanned drivers licence cannot be reset or rotated
153 million. That is the number of scanned US and Canadian drivers licences now listed for sale on a dark web marketplace called Nexus, according to security journalist Brian Krebs, who first reported the breach on 11 September.
The source is IDScan, a Louisiana-based identity verification company. Its client list includes Hertz, Target, FedEx, Motorola, and Jack Henry. If you have rented a car or bought age-restricted products at a major retailer in the past few years, your scan may be in this set.
What the dataset contains
Each record is a full scan of a physical drivers licence: photo, full name, date of birth, home address, and licence number. The seller also claims to have 10 million ID cards, 3 million travel documents, and 579,000 medical cards from the same breach.
The seller told Krebs the data had been continuously exfiltrating for over a year. In one 24-hour window, the count grew by nearly 400,000 records, which tells you the volume flowing through IDScan's systems on a normal day. The FBI's New Orleans field office has opened an investigation.
Why this is not like a password breach
Most data breaches give you something you can change. A stolen password gets rotated. A leaked credit card number gets replaced. A drivers licence scan cannot be reset. Your face, your date of birth, and your licence number are fixed identifiers, and a high-resolution scan is enough to pass many identity verification checks that rely on matching a photo to a document.
That combination is the building block for synthetic identity fraud, SIM swaps, and account takeovers at scale. An attacker with your licence scan and a few public data points can open accounts, redirect mail, and port your phone number, all without needing your password. For more on how attackers use initial access to escalate, see our explainer on privilege escalation attacks.
What you can do
There is no way to check directly whether your data is in this set until IDScan or the FBI release more details. But a few steps reduce your exposure now.
Freeze your credit with all three bureaus. It is free and prevents anyone from opening accounts in your name. Enable multi-factor authentication on every financial account, ideally with a hardware security key like the YubiKey 5 NFC rather than SMS codes, which are vulnerable to SIM swaps. Set up transaction alerts with your bank so you catch unfamiliar activity early.
Our guide to how vishing attacks work is also worth reading, since stolen identity documents make phone-based social engineering significantly more convincing.
The quiet part
IDScan is not a household name. Most people whose licences were scanned at a Hertz counter or a Target checkout had no idea a third-party vendor was storing those scans, let alone that the vendor had been leaking data for over a year without detecting it.
The FBI investigation will determine the specifics, but the pattern is familiar: a company handling sensitive biometric data at massive scale, with a breach window measured in months. The question for everyone else is how many similar verification vendors are sitting on the same kind of data with the same level of oversight.
Some links in this article are affiliate links. We may earn a small commission at no extra cost to you.
