Real-Time ID Scraping Exposes 153 Million Driver's Licenses via Identity Scanning Provider
A massive dark web operation dubbed Nexus was discovered selling roughly 153 million driver's license scans with near real-time ingestion capabilities. Newly presented driver's licenses appeared on the marketplace within hours or days of individuals presenting physical cards at businesses like rental car counters. Investigation into the inventory growth revealed that over a single 24-hour period, approximately 400,000 newly harvested cards were added to the platform's listings. This continuous expansion strongly indicates that threat actors maintained live or active access to an intermediate scanning service pipeline. Publicly available disclosures link identity verification company IDScan.net to multiple commercial clients, including Planet13 and rental car giant Hertz. The scanning platform under scrutiny routinely captures high-fidelity identity data, notably across both infrared and ultraviolet spectral bands. IDScan.net confirmed to reporting outlets that it had launched an internal investigation into the incident, while rental car representatives initially withheld comment. The capture of full-spectrum scans makes this leak significantly more severe than typical database dumps of text-based personally identifiable information. Following public reporting on the exposure, the Nexus dark website went offline, limiting opportunities for individuals to verify their records independently. The Federal Bureau of Investigation has launched an active investigation into the data pipeline breach and subsequent marketplace sales.
Commentary
This incident highlights a massive blind spot in third-party physical onboarding workflows. Identity verification devices that capture ultraviolet and infrared imaging are deployed precisely to counter sophisticated physical forgeries; exposing those exact multi-spectrum images trivializes the creation of near-perfect clone documents that can defeat hardware-level scanners. Organizations deploying edge ID-scanning hardware need to treat scan ingest endpoints like payment gateways, verifying that raw imaging buffers are purged immediately after cryptographic validation rather than cached in external cloud buckets. Security teams should audit vendor data pipelines, enforce short-lived zero-knowledge verification tokens instead of storing persistent scans, and monitor for unauthorized exfiltration channels from terminal POS and reception networks.
The Quote to Remember
“The timing of newly available scans—typically within a day, if not hours, of me and a small sample of other victims presenting them at rental companies or others—likely means that Nexus has near real-time access to data flowing through the third-party scanning service these businesses are using.”
“Using publicly available information, Krebs found that IDScan.net, a New Orleans-based ID scanning service, has announced an exclusive arrangement with Planet13. It also listed Hertz and 11 other companies as using its services. IDScan.net went on to say that its scans capture both infrared and ultraviolet spectra.”