Nexus is selling 153 million driver's licenses. The timestamps match the day you rented a car
A dark web service is offering photographed IDs of more than 153 million people in the US and Canada — front, back, infrared, ultraviolet, with the date stamped into the filename. The trail leads to a rental counter.
Last June a man flew to the American midwest for a family funeral, landed, and picked up a rental car. He handed his driver's license to the clerk at the Hertz desk. She held it behind the counter for a few minutes while the forms were signed, then gave it back. That was the whole event. Nothing was typed into a website, no password was reused, no phishing link was clicked.
This week a photograph of that license — front and back, plus infrared and ultraviolet versions of the same image — turned up for sale on a dark web service called Nexus, with the date and time of that rental appended to the filename. The man is the reporter at KrebsOnSecurity who broke the story; his Virginia license was offered as a free sample in the seller's first post on the Russian cybercrime forum Exploit. The same service claims more than 153 million driver's licenses from the United States and Canada, over 10 million ID cards, more than 3 million travel documents and at least 579,000 medical cards. A blank search with no parameters returns roughly 11.5 million pages of results. One of the records belongs to U.S. Defense Secretary Pete Hegseth.
On September 1 the New Orleans field office of the FBI opened an official inquiry into where the images came from. KrebsOnSecurity's reporting points at a widely used identity verification company based in Louisiana. The company, idscan.net of New Orleans, says it is investigating.
This is not a leak of the kind people have learned to shrug off. What escaped is not a list of email addresses and hashed passwords — it is the picture of the document itself, in the exact form a machine uses to decide whether a license is real. idscan.net's own documentation says its technology scans IDs with both infrared and ultraviolet light. The records for sale contain six image files: three pairs of front and back, one plain scan, one infrared, one ultraviolet. The layers that exist specifically to catch a fake are now, apparently, on the menu.
A password takes thirty seconds to change. A face takes a lifetime.
Then there is the part that turns a data breach into something closer to surveillance. Every image carries a date and timestamp in its filename, and the timezone appears to be GMT. The reporter asked more than a dozen friends and relatives for permission to search their names; nine were in there, and every single one confirmed they had travelled on or very near the date stamped on their file. One of them hadn't flown at all — they had a Hertz car out for several months around that date. Two were federal employees who showed other government ID at airport security, then handed over their state licenses at a Hertz counter on arrival. So the set is not only who you are. It is where you were, and when.
And the tap looks open. Over 24 hours the number of licenses listed grew by nearly 400,000. The sellers wrote in their sales post: "We have been continuously exfiltrating new data for over a year into our private database." They claim the source is an active breach at "a major identity verification company" whose customers include multiple Fortune 500 companies. If that claim holds, the leak is not a past event to be cleaned up. It is a subscription.
Anyone who has ever put a plastic card into a stranger's hands at a counter — which is most people, and it costs nothing to be in this set. You do not need a bank account, a portfolio or a single satoshi of crypto. A 24-year-old who rented a car for a road trip, showed ID at a Las Vegas dispensary or checked into a hotel is in exactly the same position as a homeowner with savings: the scan was taken once and kept somewhere neither of them chose. Security researcher Zach Edwards found his own license on sale, timestamped to the middle of his trip to DEFCON last month; he didn't rent a car, but he handed his ID to a TSA agent, a hotel and a dispensary — and the only one he is sure ran it through a device was the dispensary, a Planet13 store. Canadians too: about 1.1 million licenses, with 473,673 of them from Ontario. And the list does not sort by importance — the Defense Secretary's license sits in the same searchable index as a student's.
Three concrete things to watch, and no one has attached a deadline to any of them. First, the FBI's New Orleans office opened its inquiry on September 1 into the source of the images; nothing has been said about when it reports. Second, idscan.net — which says it performs more than 21 million verifications a month at more than 20,000 locations worldwide, and whose "trust" page lists Hertz, Target, FedEx, Motorola Solutions, Jack Henry and Caesars Entertainment — has not answered specific questions. Jillian Kossman, a marketing and operations leader there, wrote: "At this point I'm not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team's investigation." Third, Hertz was asked for comment and had not replied; KrebsOnSecurity said it will update the story if it does. The simplest number to follow is the counter on the service itself: it went up by nearly 400,000 licenses in a single day. If it keeps climbing, whatever is bleeding has not been closed.
The reporter also found his mother's license in there. Her timestamps are a few seconds from his — because they handed their two licenses to the same rental clerk at the same moment. She says the counter was the only place she showed her ID that day. Two people, one desk, one minute in June. Now indexed and searchable by strangers, and nobody ever asked either of them how long the picture would be kept.
Sources: Krebs on Security, "FBI Probes Service Selling 153M+ Drivers Licenses," September 1, 2026.
153 миллионов сканов водительских прав — с фотографиями, инфракрасными и ультрафиолетовыми снимками и датами, привязанными к конкретным поездкам, — продаются на форуме в даркнете, и утечка, судя по всему, идёт из компании, которая проверяла личность людей при аренде машины: тот, кто ни разу не имел дела с криптой, всё равно однажды показывал права у стойки проката.
Written by THE TELL’s AI newsroom. how we work · corrections