The Federal Bureau of Investigation's New Orleans field office has initiated an inquiry into a dark web service, "Nexus," which claims to be selling over 153 million driver's license scans from individuals in the United States and Canada. The service, which emerged on the Russian cybercrime forum Exploit on August 31, 2026, also advertises access to more than 10 million identification cards, over 3 million travel documents, and at least 579,000 medical cards. Among the purported victims is U.S. Defense Secretary Pete Hegseth.
The operators of Nexus assert that the images originate from an ongoing breach at a prominent identity verification company based in Louisiana. They claim to have been continuously exfiltrating new data for over a year. Evidence supporting this claim includes a nearly 400,000 increase in available driver's license records within a 24-hour period, suggesting an active data harvesting operation.
Analysis of the stolen records indicates that many include six image files per license—three pairs of front and back scans in basic, infrared, and ultraviolet formats. Each image file is appended with a date and timestamp. Researchers investigating the breach discovered that these timestamps often correspond to dates when individuals used their driver's licenses for specific transactions, such as car rentals or dispensary visits. The timestamps appear to be set to Greenwich Mean Time (GMT).
One notable pattern emerged from the investigation: several individuals whose licenses were found in Nexus had rented vehicles from Hertz around the time indicated by the timestamps. In one instance, a researcher and their mother, whose licenses were found with timestamps just seconds apart, both recalled handing their licenses to a Hertz rental car representative simultaneously. Hertz has not yet commented on the matter.
Further investigation into the timestamps and associated activities led to a potential link with IDScan.net, a New Orleans-based identity verification provider. IDScan.net's services are utilized by various major brands, including Hertz, Target, FedEx, and Motorola Solutions. The company also announced an exclusive identity verification agreement in 2022 with Planet13, a multi-state cannabis dispensary chain.
A security researcher whose driver's license was available on Nexus confirmed that its timestamp aligned with a trip to Las Vegas for the DEFCON security conference. While in Las Vegas, the researcher presented their license at a TSA checkpoint, a marijuana dispensary (Planet13), and their hotel. They specifically noted that the Planet13 dispensary scanned their ID using a device. IDScan.net states it processes ID verification for over 1,000 marijuana dispensaries across 19 U.S. states.
The Nexus service offers previews of records with sensitive information redacted, and customer photos are displayed if available. The database contains documents from both Canada and the United States, with the majority being American records. A search for Canadian driver's licenses yielded approximately 1.1 million results, with Ontario accounting for the largest concentration at 473,673 records. Curiously, some records also include marijuana dispensary cards, and certain entries are marked with "CDL" (presumably commercial driver's license) or "CAC" (possibly Common Access Cards).
