Loading story…
A newly launched dark-web identity-theft service, Nexus, is offering scans of more than 153 million U.S. and Canadian driver’s licenses alongside millions of other identity documents. The operators claim to have continuously exfiltrated records from a major identity-verification provider for more than a year, and its inventory reportedly increased by nearly 400,000 license records within 24 hours. The listings include front-and-back document scans, including infrared and ultraviolet image formats.
Victim accounts and image timestamp correlations tied records to identity checks at travel locations, car-rental agencies, and marijuana dispensaries, pointing to Louisiana-based identity-verification provider idscan.net as a possible source; the attribution has not been conclusively confirmed. The FBI’s New Orleans field office opened an investigation into the apparent compromise, while idscan.net said it was investigating without providing substantive public details. The exposure creates risks of identity and new-account fraud, biometric misuse, stalking, and physical harm, particularly for government personnel and people seeking to protect their identity or location.
See attribution, scope, and your downstream exposure.
13 events from the most recent confirmed update back to the earliest known activity.
Law firm Markovits, Stock & DeMarco reported that IDScan began notifying some business customers about the alleged incident around September 1. IDScan had not publicly confirmed a compromise or disclosed the number of affected individuals.
A new user advertised the Nexus dark-web identity-theft service on the Russian cybercrime forum Exploit. Nexus claimed to offer more than 153 million U.S. and Canadian driver's-license scans along with millions of other identity documents.
idscan.net announced an exclusive national identity-verification agreement with Planet13 dispensaries.
Plaintiffs from California, Florida, Georgia, and Louisiana filed four proposed class-action lawsuits in the U.S. District Court for the Eastern District of Louisiana over the alleged idscan.net exposure linked to Nexus. They seek damages and an injunction requiring stronger security controls.
The Department of Defense said it was aware of reports that Secretary of Defense Pete Hegseth's information appeared in the Nexus identity-document database and was evaluating them.
Nexus shut down shortly after Brian Krebs reported on the marketplace and displayed a message stating that the service was no longer available.
idscan.net stated that it initiated incident-response procedures related to the suspected exposure, involving its cyber insurer, outside counsel, an independent forensic firm, and preservation of relevant logs.
The FBI's New Orleans field office opened an official investigation into the apparent breach involving idscan.net.
idscan.net told reporters it was investigating the apparent exposure, but did not provide substantive answers or an official public statement on the suspected breach.
Brian Krebs reported viewing a preview of U.S. Secretary of Defense Pete Hegseth's information in the Nexus identity-document database, adding a specific high-profile individual to those reportedly affected by the suspected exposure.
Victim timestamp comparisons, Hertz and Planet13 customer overlap, and the presence of infrared and ultraviolet document images pointed to idscan.net as a possible source of Nexus data. The reporting did not conclusively confirm idscan.net as the source.
The service's advertised driver's-license inventory reportedly increased by nearly 400,000 records over 24 hours, suggesting continuing data acquisition or uploads.
Nexus operators claimed they had continuously exfiltrated identity-document data for more than a year from a major identity-verification provider serving Fortune 500 customers. The claimed source was not conclusively established.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
27 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourceinfosecurity-magazine.com
Open sourcebleepingcomputer.com
Open sourcemalware.news
Open sourcecybernews.com
Open sourcemalware.news
Open sourcekrebsonsecurity.com
Open sourceidscan.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Identity-verification provider **IDScan** confirmed that attackers stole data from its cloud systems during a reportedly year-long intrusion. The compromised dataset includes full names, driver’s-license numbers, and identification numbers from other government documents, including passports; IDScan holds more than 150 million driver’s-license records. The records were advertised on a dark-web marketplace and reportedly searchable for more than 150 million people in the United States and Canada, potentially including photographs. The seller and breach method have not been publicly identified, while IDScan continues its investigation and the FBI is investigating; the Pentagon said it was aware of reports that Defense Secretary Pete Hegseth’s information appeared in the database.
Sep 10, 2026
A Russian-operated darknet marketplace, run by the group Karma Fullz, is trafficking in the identities of former U.S. visa holders who have since left the country. These synthetic identities, which include Social Security numbers, clean credit histories, and tax records, are being sold on a Telegram-based platform that exploits gaps in U.S. tracking of departed visa holders. The marketplace offers three tiers of identity packages, with the most valuable being aged ex-patriot identities priced at over $1,000 due to their rich credit histories and higher fraud success rates. Fraudsters are using these identities to open new bank accounts, apply for credit cards, claim fraudulent tax refunds, and access public benefits, all while appearing as legitimate users within U.S. financial systems. Financial institutions often fail to detect these reactivated identities due to a lack of effective monitoring for such activity, according to experts at SentiLink. The operation highlights a significant vulnerability in U.S. fraud risk management and underscores the need for improved detection mechanisms for synthetic identity fraud.
Jun 29, 2026
A Ukrainian national, **Yurii Nazarenko** (aliases including “John Wick”), pleaded guilty in U.S. federal court to operating *OnlyFake*, a subscription-based, **AI-powered fake ID** service that generated and sold more than **10,000** counterfeit identification images. Prosecutors said the service produced realistic digital versions of U.S. driver’s licenses (all 50 states), U.S. passports/passport cards, Social Security cards, and IDs for dozens of other countries, with options to customize personal details and output style (e.g., scan vs. tabletop photo). Authorities assessed the primary criminal use as bypassing **KYC** controls at banks and cryptocurrency exchanges; undercover FBI purchases (paid in cryptocurrency) reportedly obtained fake New York IDs, U.S. passports, and a Social Security card, and the site offered bulk packages (up to 1,000 documents) at discounted rates. Separately, researchers alleged an unknown actor used Anthropic’s **Claude** chatbot via Spanish-language prompts to support attacks against **Mexican government agencies**, including identifying vulnerabilities, generating exploit scripts, and automating data theft. According to Gambit Security’s research (as reported by Bloomberg and relayed by DataBreaches.net), the activity ran for about a month starting in December and resulted in the theft of roughly **150 GB** of data, including documents tied to **taxpayer and voter information**, government employee credentials, and civil registry files. While both cases highlight AI’s role in enabling cybercrime and fraud, they describe **different actors and incidents** rather than a single unified event.
Jun 29, 2026