A dark web service that called itself Nexus claimed to have amassed more than 153 million driver's license records from the United States and Canada, along with millions of other identity documents, according to an investigation by cybersecurity journalist Brian Krebs. The FBI has confirmed it is examining the matter, telling Reuters it was «looking into the incident» but declining to provide further details because the inquiry is ongoing.
The scale of the claimed collection, if verified, could rank among the largest exposures of government-issued identity documents in North America. Nexus advertised access to identity documents covering more than 170 million people, with driver's licenses making up the largest category. The service also claimed to hold more than 10 million identification cards, over 3 million travel documents or international IDs, and at least 579,000 medical cards.
KrebsOnSecurity reported that Nexus appeared on the Russian-language cybercrime forum Exploit on Aug. 31. Krebs tested the service by running a blank search, which returned roughly 11.5 million pages of results with about 15 records per page. That does not prove 153 million different people were in the database, but it supports the possibility that the collection was enormous. More concerning, the driver's license total increased by nearly 400,000 records in about 24 hours while Krebs was examining the service. The people running Nexus claimed they had been continuously taking new data for more than a year, a claim investigators have not independently verified.
Krebs discovered his own Virginia driver's license being offered as a free sample by the people promoting Nexus. His record contained six image files, including images of the front and back of his license, along with infrared and ultraviolet versions. He then asked friends and family members for permission to search for their licenses. Nine people whose licenses appeared in Nexus said the timestamps closely matched dates when they had traveled or presented identification. That led investigators away from the idea that airport security alone might explain the records.
For example, Krebs reported that he had used his passport at airport security during one trip. Later that day, he and his mother handed their driver's licenses to a Hertz rental car representative. Their driver's license scans in Nexus carried timestamps only seconds apart. Security researcher Zach Edwards also found his license in Nexus. His timestamp lined up with a trip to Las Vegas, where he said he had presented his license in several places. He specifically remembered having it scanned at Planet 13, a marijuana dispensary.
The Planet 13 connection pointed researchers toward Louisiana-based identity verification company, which announced a partnership with the dispensary in 2022. Its scanners can capture IDs using ultraviolet, infrared and white light, similar to the additional scans found in some Nexus records. has since acknowledged a security incident. The company says an unauthorized third party may have accessed or copied customer information stored in accounts on its cloud. That information may include full names and driver's license or other government-issued identification numbers. says it is notifying potentially affected people and offering free credit monitoring. However, the company has not confirmed that the Nexus collection came from its systems or that the 153 million records represent 153 million unique people.
Shortly after KrebsOnSecurity published its investigation, the Nexus dark web site disappeared. Its login page was replaced with a message saying the service was no longer available. That does not mean the stolen records disappeared with it. Anyone who purchased or downloaded information before the site vanished could potentially retain copies.
A driver's license holds information criminals can use to make impersonation attempts much more convincing. Depending on the state, it may include a full name, address, date of birth, license number, photograph and signature. A high-quality image of the front and back can also give a criminal something physical to present during an identity check. That can become especially concerning when businesses use driver's licenses to verify identity for age-restricted products, car rentals or other services.
The FBI's involvement signals the seriousness of the potential breach, though much remains unconfirmed. The 153 million figure comes from Nexus itself and has not been verified as the number of unique people affected. Some records also contained multiple images of the same license. Still, researchers found enough real driver's licenses in the database to get the bureau's attention. As the investigation continues, the incident serves as a reminder that handing over an ID for scanning can carry risks that outlast the moment of verification.