Car Rental ID Scan Led to 153M Driver's Licenses on Dark Web
Original: I rented a car, and within hours, my driver's license was for sale
Why This Matters
A live breach of a widely-used ID scanning vendor puts tens of millions of consumers at immediate identity theft risk.
A journalist rented a car and within hours found his driver's license for sale on a dark web marketplace called Nexus. The site lists over 153 million driver's licenses, growing by ~400,000 per day. The FBI is reportedly investigating the breach, which is linked to ID scanning service IDScan.net.
KrebsOnSecurity published an exposé on September 2, 2026, revealing that a dark web ID theft service called Nexus is selling high-resolution scans of over 153 million driver's licenses — including those of journalist Brian Krebs, his mother, an FBI assistant director, and multiple security researchers. Ars Technica's Dan Goodin confirmed his own license appeared on the site within hours of presenting it at a car rental company.
Nexus offers front and back scans captured in standard, infrared, and ultraviolet image formats — details that could potentially help counterfeit IDs pass hologram verification checks. The site also advertises identification cards, travel cards, Common Access Cards (which grant physical access to government buildings), medical cards, employment authorization cards, and marijuana dispensary cards.
The near real-time availability of newly scanned IDs — often within hours of presentation — strongly suggests an active compromise of a third-party ID scanning provider. Krebs identified IDScan.net, a New Orleans-based ID scanning company, as a likely source. IDScan.net has announced an exclusive arrangement with multi-state cannabis chain Planet13 and lists Hertz among 12 other clients. The company confirmed it is investigating. The number of listed records grew by approximately 400,000 in a single 24-hour period, indicating the breach is ongoing. The FBI is reportedly investigating.