Nexus: A Dark-Web Shop Sold 153M Driver's Licenses — and the Timestamps Point at a Rental Car Counter

What Nexus was selling//

On Monday, Aug. 31, a new user on the Russian Exploit forum launched a service called Nexus, offering digital scans of identity documents for more than 170 million North Americans. The proprietor offered Brian Krebs's own Virginia driver's license as a free sample in the initial sales thread — which is how this got started.

The claimed inventory:

• 153M+ drivers licenses (US and Canada)
• 10M+ identification cards
• 3M+ travel documents / international IDs
• 579K+ medical cards — some of them marijuana dispensary cards

And the numbers held up under a quick check: a blank search in Nexus returned roughly 11.5 million pages at ~15 results per page, and searching for Canadian licenses alone came back with about 1.1M records (Ontario was the biggest concentration, at 473,673). Some records carry source notations like "CDL" — presumably commercial drivers license — or "CAC," which may mean Common Access Cards, the government-issued IDs that get people into federal buildings and secure rooms.

It was also growing. In the first 24 hours alone, Nexus added nearly 400,000 more licenses. The operator boasted they'd been "continuously exfiltrating new data for over a year into our private database" — and the growth rate suggested the tap was still open.

What each record actually is//

Each record is six image files: three pairs (front/back photos), plus infrared and ultraviolet scans of the same license, with a date and timestamp appended to every file. The timestamps are what make this dataset special — they let you reconstruct exactly where and when your license was scanned.

Krebs matched his own record's timestamp to a June 2025 flight he'd taken for a family funeral. But that day he'd shown his passport at TSA (he didn't yet have a Real ID) — so the scan wasn't from an airport. He then found nine of twelve friends and family in the trove, and every one had timestamps matching real travel or rental-car dates.

Where it came from: not airports, probably counters//

Two facts killed the airport theory fast: there were no passports in the dataset, and several matched people hadn't flown at all around their scan date. The traces kept pointing somewhere else — Hertz. One matched person had been renting a Hertz car for months around their timestamp. Two federal employees said they'd shown other government IDs at TSA that day but handed state-issued licenses to Hertz counters later, both times. And the clincher: Krebs found his mother's license with timestamps seconds apart from his own — because they'd both handed their licenses to the same rental-counter rep at the same time, and she said the only place she gave her license that day was the car rental company.

There's a dispensary angle too. Security researcher Zach Edwards (DecryptAds) had a record matching the middle of his trip to Las Vegas for DEFCON; he'd shown his license at TSA, at a hotel, and at a weed shop — but only one of those definitely scanned it: Planet13, which announced an exclusive identity-verification deal with idscan.net back in 2022.

That's the suspected source. idscan.net is a New Orleans-based identity-verification vendor (VeriScan) whose "trust" page lists Hertz, Target, FedEx, Motorola Solutions, Jack Henry, and Caesars as clients; it claims more than 21 million verifications monthly at 20,000+ locations worldwide, scanning IDs with infrared and ultraviolet — exactly the image types sitting in Nexus.

The attribution nuance matters: Krebs writes that the trove appears to be siphoning images collected by idscan.net — a suspected source, not a confirmed one. The vendor said it is investigating but has issued no official statement (its emailed reply, via Krebs: "At this point I'm not able to share any additional information"). And one listed client pushed back: Caesars Entertainment says it stopped using VeriScan in February 2025 and never authorized IDScan to retain its data — despite still appearing on idscan.net's trust page.

Who else is in there//

Krebs found the license of Defense Secretary Pete Hegseth — "one of several high-ranking U.S. government officials" available for sale. He also noted that Nexus was selling the license of the FBI's assistant director (Director Kash Patel's wasn't in the set, so far as he could tell). Word got to the FBI's New Orleans field office, which opened an official inquiry on Sep 2; TIME confirmed the bureau is "looking into the incident" but declined to comment further.

Security researcher Larry Baldwin (Cybera) pointed out who this hurts most: state licenses are the standard proof of identity for opening new lines of credit, and a searchable trove of ID images is dangerous for people who don't want to be found — domestic-violence survivors, witness-protection participants — especially when AI image matching makes "just change your appearance" harder. LSE's Edgar Whitley put it best: "You can reissue a new password but not a new face."

Then, the evening of Sep 2 — hours after Krebs published — Nexus's site vanished, replaced by a plain-text note: "This service is no longer available."

What to do tonight//

1. Freeze credit at all three bureaus — Equifax, Experian, TransUnion. This is the single highest-value move: licenses are the proof-of-identity for new credit lines, and a freeze makes stolen scans expensive to use (it's free and reversible).
2. Place a fraud alert / report at IdentityTheft.gov if you suspect active misuse — it flags lenders to verify harder before opening accounts in your name.
3. Ask your ID-scanning vendors about retention. NIST's SP 800-63 digital identity guidelines push verification providers to collect only what the transaction needs and limit how long they keep it — "what do you retain, and for how long?" is a fair customer question now that we know some of them answer "forever, apparently."
4. Watch for the shop to reopen. Krebs expects something like Nexus back on the dark web; per the Identity Theft Resource Center, this dataset keeps its value to cybercriminals for years after a breach surfaces.