Massive Dark Web Leak Exposes Over 153 Million North American Driver’s Licenses Tied to Identity Verification Firm Breach

By Investigative Staff
Updated September 8, 2026

Main Facts

A sophisticated new identity theft operation on the dark web has upended digital security across North America by listing digital scans of more than 153 million driver’s licenses belonging to citizens in the United States and Canada. The illicit service, operating under the moniker "Nexus," emerged on a prominent Russian-language cybercrime forum, offering instantaneous search capabilities across massive troves of personally identifiable information (PII).

In addition to the staggering volume of driver’s licenses, Nexus claims to house more than 10 million state and provincial identification cards, at least 3 million international travel documents, and roughly 579,000 medical and dispensary cards. High-ranking U.S. officials—including Defense Secretary Pete Hegseth and a senior assistant director of the Federal Bureau of Investigation—have been identified among the exposed records, underscoring the indiscriminate and sweeping nature of the breach.

Preliminary investigations, supported by cross-referencing timestamps and travel records of affected individuals, strongly point to an active, long-term data exfiltration campaign originating from a major identity verification firm: IDScan.net, a Louisiana-based enterprise that processes millions of verification requests for Fortune 500 corporations, government agencies, rental car companies, and national cannabis dispensary chains.

The FBI’s New Orleans field office has launched an official criminal inquiry into the incident, while cybersecurity experts warn that the leak presents unprecedented risks to financial security, consumer privacy, and vulnerable populations such as domestic violence survivors and individuals in witness protection programs.

Chronology of the Incident

• June 2025: Timestamps embedded in metadata for records such as investigative journalist scans and travel documents correspond precisely with domestic flights, rental car pickups, and dispensary visits, indicating that data collection or exfiltration was already active.
• Monday, August 31, 2026: A dark web intelligence source alerts security researchers to a newly registered user on the Russian cybercrime forum Exploit. The threat actor advertises Nexus, using a prominent cybersecurity researcher’s driver’s license as a promotional "free sample."
• September 1–2, 2026: Researchers conduct sample audits of the database. The number of listed driver’s license records surges by nearly 400,000 within a 24-hour window, confirming that the underlying database is being continuously updated with freshly harvested material.
• Afternoon of September 2, 2026: Cybersecurity researchers are briefed by senior leaders from the FBI’s cyber division, confirming that the Bureau’s New Orleans field office has opened an official investigation into IDScan.net.
• Evening of September 2, 2026: Shortly after initial reports are published, the Nexus dark web portal abruptly vanishes, replacing its login interface with a static plain-text message: "This service is no longer available."
• September 8, 2026: IDScan.net formally publishes an incident notification admitting that an unauthorized third party accessed and copied customer data, including full names and government-issued identification numbers.

Supporting Data and Scope of the Breach

The sheer scale of the Nexus database separates it from typical credential-stuffing dumps or localized retail leaks. A blank-parameter search across the platform’s backend reveals approximately 11.5 million pages of indexed records, averaging 15 distinct profiles per page.

While the majority of the targets are U.S. citizens, Canadian records are heavily represented. A targeted search for Canadian licenses yields roughly 1.1 million results, with the province of Ontario accounting for nearly half a million entries.

Crucially, the records are not limited to standard driver’s licenses. Researchers identified multiple anomalies within the dataset:

• Enhanced Metadata: Many entries include up to six distinct image files, encompassing standard front-and-back scans alongside specialized infrared and ultraviolet captures. These advanced spectral images are typically generated by enterprise-grade hardware scanners used to detect fraudulent IDs.
• Specialized Credentials: The database features commercial driver’s licenses (CDLs), marijuana dispensary consumer cards, and government-issued Common Access Cards (CACs) utilized for physical entry into secure facilities.
• Temporal Precision: Every analyzed file features an appended date and timestamp. Interviews with nearly a dozen individuals whose records were found on Nexus confirmed that these timestamps match the exact window during which they presented their identification to third-party vendors—most notably car rental agencies such as Hertz and multi-state dispensary chains like Planet13.

Official Responses

As the fallout from the Nexus leak reverberates through corporate boardrooms and federal agencies, impacted companies and law enforcement have begun issuing statements.

IDScan.net

Following initial denials and requests for time to investigate, IDScan.net issued a formal security notice on September 8. The company acknowledged that an unauthorized actor gained access to systems containing customer information, full names, and government-issued identification data. IDScan.net stated it is actively notifying affected individuals and providing complimentary credit protection services.

Caesars Entertainment

In a rapid clarification following initial reports linking IDScan.net to major hospitality brands, a spokesperson for Caesars Entertainment firmly distanced the company from the incident. Caesars stated it ceased using the VeriScan platform in February 2025, maintained no active accounts at the time of the breach, and did not authorize IDScan.net to retain historical consumer data.

Federal Bureau of Investigation

The FBI’s New Orleans field office initiated an emergency inquiry on September 2, 2026. The investigation was fast-tracked after realizing high-ranking federal law enforcement officials and cabinet members—including U.S. Defense Secretary Pete Hegseth—had their sensitive identity documents exposed on the platform.

Implications for Privacy and Digital Security

Cybersecurity analysts emphasize that the compromise of 153 million North American identification scans represents a systemic failure in how modern institutions collect and retain biometric and biographical data.

Financial Fraud and Credit Identity Theft

State-issued driver’s licenses remain the gold standard for remote and in-person identity verification. With bad actors possessing high-resolution, front-and-back scans—complete with UV and IR imaging variants—the barrier to opening fraudulent lines of credit, bank accounts, and cryptocurrency wallets has been drastically lowered. Traditional knowledge-based authentication (KBA) protocols will struggle to protect consumers whose baseline documents are entirely exposed.

Endangering Vulnerable Populations

Privacy advocates have expressed grave concern over the safety of marginalized and high-risk groups. Unlike passwords or credit card numbers, a driver’s license cannot be easily reissued with entirely different facial biometrics. Larry Baldwin, principal intelligence researcher at Cybera, noted that modern AI-powered facial recognition tools can easily bridge minor changes in appearance. This exposes individuals who rely on strict privacy for their physical safety, including:

• Survivors of domestic violence attempting to shield their locations from abusers.
• Individuals integrated into federal witness protection programs.
• Public officials and judicial officers facing targeted harassment.

The Over-Collection Paradox

Industry experts argue this incident must serve as a reckoning regarding the pervasive collection of personal data under the banner of security and compliance. Zach Edwards, privacy researcher and creator of DecryptAds, criticized the modern regulatory landscape that compels businesses, hotels, dispensaries, and retailers to scan and store government identification.

"These systems are putting sensitive data into more and more third-party vendors," Edwards remarked, "and we don’t have nearly the oversight to ensure they are safe."

Even though the Nexus dark web portal has taken its operational infrastructure offline, security professionals warn that the exfiltrated database has likely already been duplicated, archived, and distributed among elite cybercriminal syndicates. The long-term ramifications for North American identity verification protocols will likely be felt for decades to come.