Real-Time ID Scraping Exposes 153 Million Driver's Licenses via Identity Scanning Provider
A massive dark web operation dubbed Nexus was discovered selling roughly 153 million driver's license scans with near real-time ingestion capabilities. Newly presented driver's licenses appeared on the marketplace within hours or days of individuals presenting physical cards at businesses like rental car counters. Investigation into the inventory growth revealed that over a single 24-hour period, approximately 400,000 newly harvested cards were added to the platform's listings. This continuous expansion strongly indicates that threat actors maintained live or active access to an intermediate scanning service pipeline. Publicly available disclosures link identity verification company IDScan.net to multiple commercial clients, including Planet13 and rental car giant Hertz. The scanning platform under scrutiny routinely captures high-fidelity identity data, notably across both infrared and ultraviolet spectral bands. IDScan.net confirmed to reporting outlets that it had launched an internal investigation into the incident, while rental car representatives initially withheld comment. The capture of full-spectrum scans makes this leak significantly more severe than typical database dumps of text-based personally identifiable information. Following public reporting on the exposure, the Nexus dark website went offline, limiting opportunities for individuals to verify their records independently. The Federal Bureau of Investigation has launched an active investigation into the data pipeline breach and subsequent marketplace sales.
Read more about Real-Time ID Scraping Exposes 153 Million Driver's Licenses via Identity Scanning Provider