Driver’s licenses for sale on the dark web: How businesses should respond

The alleged exposure of 153 million driver’s license scans highlights growing identity fraud, impersonation, and third-party supply chain risks.

Key takeaways

• A dark web service reportedly offered more than 153 million U.S. and Canadian driver’s license scans.
• The exposed records may include front-and-back images and infrared and ultraviolet scans used for identity verification.
• Individuals should watch for identity fraud, impersonation, and suspicious attempts to open accounts or obtain benefits.
• Organizations should review identity-verification vendors and strengthen controls against phishing, account takeover, and physical impersonation.

Last month, a KrebsOnSecurity investigation alerted readers to a potential breach involving over 153 million drivers’ licenses from Canada and the United States. The leak reportedly includes driver’s licenses belonging to Brian Krebs himself, an assistant director of the FBI, Secretary of Defense Pete Hegseth, and potentially your driver’s license as well. What happened, were you affected, and how do you defend yourself from the ensuing business risks?

What information was exposed in the driver’s license breach?

In last August, security researcher Brian Krebs was alerted to a new service, known as Nexus, being offered on a Russian cybercrime forum. Krebs uncovered over 153 million personal and commercial licenses for sale, plus millions of additional documents. These included access cards allowing individuals to achieve physical entry to secure facilities.

Perhaps most troublingly, these documents were being offered at a forensic level of detail. A purchase from Nexus included front and back images of a stolen ID card, plus scans in infrared and ultraviolet light. This could make it easy to forge ID cards — even Real ID cards — that would pass both visual and digital inspection.

How were 153 million driver’s license scans allegedly stolen?

In addition to the visual information, each stolen record contained a timestamp which seemed to indicate when the license was stolen. This proved to be a major clue because the author — as well as several other victims contacted for research purposes — had all been traveling and had rented cars around the same time their IDs were stolen.

One victim noted that, separately from renting a car, he had visited a cannabis dispensary in Las Vegas known as Planet13. That chain in particular uses an identity provider known as idscan.net. In addition to providing ID verification for cannabis dispensary chains, idscan.net also advertises itself as working with companies such as Hertz, Target, and FedEx. The company confirmed the breach on September 4.

What we see here is evidence of a massive supply chain attack. The ID verification company acted as a single bottleneck that captured detailed information for multiple companies. When that single company was breached, its customers and their users may have had data exposed through the compromised provider.

How can you tell if your driver’s license was exposed?

Unfortunately, the attackers behind Nexus seem to have gotten spooked by the increasing attention from security researchers and investigative agencies. They pulled their database offline as of September 1, which means that it’s not possible to check to see whether your information was compromised.

That being said, Nexus was adding new driver’s license images right up until they pulled their database offline. If you scanned your driver’s license with an idscan.net customer at any point between June 2025 and September 1, 2026, then you should consider your information potentially exposed.

What’s more, the removal of the service doesn’t mean that the database has gone anywhere. The attackers may still be selling access to it privately through other channels.

What should you do if your driver’s license data was stolen?

If you provided your license to an idscan.net customer, you currently face two major risks. First, a bad actor could create a convincing replica of your license and use it to obtain fraudulent services. Imagine someone using a copy of your license to apply for unemployment insurance, a credit card, or some other benefit. Unfortunately, traditional credit monitoring services may be unable to compensate for a stolen driver’s license.

Second, an attacker could use this information to physically impersonate an individual. For example, many of the stolen ID cards were privileged access cards that would let someone enter a building or secure location. Forging an access card would let an attacker breach these locations. If you suspect that your access card was stolen in this breach, you need to contact your security manager immediately so they can issue a new credential.

How can businesses reduce identity-verification vendor risk?

For organizations, the exposure creates risks beyond individual identity theft. Driver’s license scans can make phishing, help-desk impersonation, account takeover, benefits fraud, and attempts to gain physical access more convincing. Identity-verification providers are especially attractive targets because they aggregate sensitive documents from many businesses and users in one place. Organizations should therefore treat these vendors as part of their security perimeter rather than relying on a completed identity check as proof that risk has been transferred.

Organizations should inventory every vendor that collects or processes identity documents and review what data each provider retains, where it is stored, how long it is kept, and how it is deleted. Contracts should define minimum security controls, breach-notification timelines, audit rights, and data-deletion requirements. Security teams should also assess vendor API and cloud protections, strengthen help-desk verification procedures, and avoid treating a driver’s license image alone as sufficient proof of identity.

How Barracuda helps strengthen identity resilience

A third-party breach can put sensitive identity data beyond an organization’s direct control. The next priority is preventing attackers from using that information to impersonate employees, compromise accounts, escalate privileges, or move laterally through the environment.

Barracuda Identity Resilience solutions help organizations protect, detect, respond to, and recover from identity-based attacks by combining identity-risk visibility, zero-trust access controls, continuous threat detection and response, and identity recovery.

Because stolen identity data can also make phishing and impersonation attempts more convincing, Barracuda Email Protection adds another layer of defense against targeted phishing, suspicious sign-ins, compromised accounts, and fraudulent messages sent from trusted mailboxes.

Frequently asked questions

Was idscan.net breached?

Idscan.net confirmed a data security incident on September 4, 2026. Reporting linked the incident to a dark web service that reportedly offered access to millions of driver’s license scans and other identity documents.

How many driver’s license scans were reportedly exposed?

The Nexus service reportedly offered more than 153 million U.S. and Canadian driver’s license scans, along with millions of other documents. The complete scope and the number of unique individuals affected may not yet be confirmed.

What can criminals do with a stolen driver’s license scan?

A detailed scan can support identity fraud, document forgery, phishing, account recovery abuse, and impersonation. If the exposed record is a physical access credential, it could also increase the risk of unauthorized entry.

What should organizations do after an identity-verification vendor breach?

Organizations should identify affected users and credentials, follow the vendor’s incident guidance, monitor for impersonation and account takeover, and replace exposed physical access credentials where appropriate. They should also reassess vendor data-retention practices, contractual protections, API security, and internal identity-verification procedures.