A dark website is selling 153 million driver's licenses, likely harvested in real-time from ID scanning services used by rental companies, leading to an FBI investigation.
<p>Not long ago, I rented an SUV from a well-known car rental company. Within hours of an employee scanning my driver's license, a high-resolution scan of my ID was available for sale on the dark web.</p>
<p>An <a href="https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/">exposé published Tuesday</a> by KrebsOnSecurity reports that my license was one of more than 153 million that were available through Nexus, the name of the new ID theft service. Like other driver's licenses available there—including some belonging to journalist Brian Krebs, his mother, an FBI assistant director, and several security researchers—my license was purported to include multiple image files showing both the front and back of the ID. Besides a basic image scan, the files also captured the images in the infrared and ultraviolet spectrums. Presumably, the additional formats may allow cloned-based counterfeit IDs to pass hologram tests.</p>
<h2>Growing by the day</h2>
<p>Besides advertising the availability of driver's licenses, Nexus offered to sell a bevy of other forms of ID. They included:</p><p><a href="https://arstechnica.com/security/2026/09/my-drivers-license-is-one-of-153-million-for-sale-on-a-new-dark-website/">Read full article</a></p>
<p><a href="https://arstechnica.com/security/2026/09/my-drivers-license-is-one-of-153-million-for-sale-on-a-new-dark-website/#comments">Comments</a></p>
# I rented a car, and within hours, my driver's license was for sale
Source: [https://arstechnica.com/security/2026/09/my-drivers-license-is-one-of-153-million-for-sale-on-a-new-dark-website/](https://arstechnica.com/security/2026/09/my-drivers-license-is-one-of-153-million-for-sale-on-a-new-dark-website/)
The timing of newly available scans—typically within a day, if not hours, of me and a small sample of other victims presenting them at rental companies or others—likely means that Nexus has near real\-time access to data flowing through the third\-party scanning service these businesses are using\. Over a span of 24 hours, Krebs said the number of driver’s licenses listed as available grew by almost 400,000\. That’s another indication that the breach has been ongoing and new cards become available shortly after they’re harvested\.
Using publicly available information, Krebs found that[IDScan\.net](https://arstechnica.com/security/2026/09/my-drivers-license-is-one-of-153-million-for-sale-on-a-new-dark-website/%E2%80%8B%E2%80%8Bhttp://idscan.net/), a New Orleans\-based ID scanning service, has[announced](https://idscan.net/press-release/planet-13-partners-with-idscan-net/)an exclusive arrangement with Planet13\. It also listed Hertz and 11 other companies as using its services\. IDScan\.net went on to[say](https://idscan.net/press-release/2025-id-fraud-report/)that its scans capture both infrared and ultraviolet spectra\.
Representatives from IDScan didn’t immediately answer questions sent by email\. An IDScan\.net spokesperson told Krebs the company is investigating\. My car rental company representatives also didn’t immediately answer questions\.
The availability of my driver’s license to anyone willing to cough up a fee isn’t exactly a comforting thought\. Yes, my personal details—including current and former addresses, Social Security number, demographics, and more—have been breached before, just as they have for millions, if not billions, of others around the world\.
This dump is more troubling because of the purported availability of scans in ultraviolet and infrared\. Fortunately, Nexus went dark within hours of the KrebsOnSecurity scoop, although that also means there’s no way for people to check if their IDs are included\. Also somewhat consoling is the ongoing investigation by the FBI\.
The FBI is investigating a dark web service called Nexus that sells digital scans of over 153 million U.S. and Canadian drivers licenses, potentially sourced from a breach at a major identity verification company.
A dark web service named Nexus is offering access to over 153 million U.S. and Canadian driver's licenses, likely from a breach at identity verification company IDScan, raising national security concerns due to potential use in espionage and identity theft.
The FBI announced plans to purchase nationwide access to automated license plate reader networks for near-real-time vehicle tracking, raising significant privacy concerns.
The FBI plans to purchase nationwide access to automated license plate reader data for up to $36 million, allowing warrantless tracking of vehicles across the US.
Automakers like General Motors collect and sell customer driving data without clear consent, leading to FTC penalties and highlighting widespread privacy issues in the automotive industry.