Urgent identity-theft investigation
A criminal marketplace claimed it could sell more than 153 million U.S. and Canadian driver-license records. Some documents are demonstrably real and the FBI is investigating—but the headline number, the total number of unique victims, and the suspected source have not been conclusively established.
Reporting cutoff: September 3, 2026, 12:25 p.m. Eastern. This is a fast-moving investigation; we will label material updates.
Bottom line: Treat the risk seriously, but do not repeat the marketplace’s sales pitch as a proven breach total. “153 million” is the Nexus operators’ claimed inventory. It is not yet an audited count of unique people, and IDScan.net has not publicly confirmed that it was the breached source.[1][2][3]
Update — September 6: a new “195 million” resale claim does not add up
What is new: A September 6 video from The Intel Desk says a new dark-web seller is advertising roughly 195 million U.S. and Canadian identity records and repeats the exact 153,347,439 driver-license count associated with Nexus.[9] The video itself labels the 195 million total unverified.[9] The IT Guys has not independently authenticated the pictured forum post, the seller, ownership of the data, the dataset’s provenance, or the claim that these records have been held for years.
The arithmetic warning: The nine category figures circulated with the advertisement total 173,256,797 records—not 195 million.[9] That leaves an unexplained difference of 21,743,203 records. The available material does not show whether the headline includes omitted categories, duplicates, a different counting method, or simply an inaccurate sales claim.
These nine figures are a transcription of the alleged listing shown in The Intel Desk video. They verify what the pictured advertisement claims—not the screenshot’s authenticity, the seller’s possession, or the data itself.[9]
What the matching number means: Repeating Nexus’s exact driver-license count is a reason for investigators to examine the advertisement; it is not proof that the seller owns the Nexus collection, that the data is fresh or complete, or that 195 million distinct people are affected. KrebsOnSecurity’s earlier investigation established that some Nexus records were real, while the total inventory and unique-victim count remained seller claims.[1]
What readers should do: This update does not create a reliable lookup for individual exposure and does not justify visiting a criminal forum. The defensive steps below—credit freezes, account monitoring, official DMV contact when misuse appears, and skepticism toward unsolicited “breach help”—remain the practical response.
Update reporting cutoff: September 6, 2026, 3:21 p.m. Eastern / 19:21 UTC.
What investigators actually found
Confirmed or directly observed
- A dark-web service called Nexus advertised a huge searchable inventory of identity documents.
- KrebsOnSecurity viewed the service, found Brian Krebs’s own license used as a promotional sample, and matched records with their real holders.
- The FBI told Reuters and TechCrunch that it is looking into the incident.
- Nexus disappeared shortly after the investigation was published.
Not yet confirmed
- That all 153 million advertised license records are genuine.
- That they represent 153 million unique people or unique credentials.
- That IDScan.net is definitively the compromised source.
- That the operators retained access after the marketplace went offline.
- How many Floridians—or customers of any named business—are affected.
Krebs asked more than a dozen friends and relatives for permission to search the service. The nine whose licenses appeared said the attached timestamps aligned with travel on or near those dates. Some matches aligned with car-rental activity, and security researcher Zach Edwards found a scan corresponding to a Las Vegas trip. Those clues helped investigators focus on a Louisiana identity-verification provider, but they do not prove that every associated merchant—or IDScan itself—was breached.[1]
What the criminals claimed to hold
These are marketplace claims, not official breach-notification totals. A blank Nexus search returned roughly 11.5 million pages with about 15 results per page, and a Canada-only search returned about 1.1 million license results, according to Krebs. Some records contained multiple images of one credential—including front, back, infrared and ultraviolet captures—so “record,” “image,” “license,” and “person” must not be treated as interchangeable units.[1]
Nexus also claimed it had been exfiltrating data for more than a year. Krebs observed the advertised license count rise by nearly 400,000 in 24 hours, which was consistent with—but did not prove—the criminals’ claim of continuing access. The site then went offline after the report.[1]
Why IDScan.net is suspected—and why suspicion is not confirmation
The attribution rests on converging clues: document timestamps matched situations in which people had presented IDs; several records aligned with Hertz rentals; another aligned with a visit to a dispensary that publicly used IDScan technology; and some exposed records contained the same kinds of infrared and ultraviolet captures described in ID-verification systems. IDScan’s chief operating officer told Krebs the company was investigating, while Reuters said it could not establish the stolen data’s source.[1][2]
Watch the CBS News report
CBS News interview: 4 minutes, 5 seconds
CBS News published this segment at 8:03 a.m. Eastern on September 3. It features former CISA director Chris Krebs discussing the reported exposure.[4]
Watch the report on CBS News →
The IT Guys links to CBS’s original page. We do not copy, download or rehost the footage.
Why a license scan is more dangerous than a leaked password
It is durable
You can reset a password. Your face, date of birth, address history and the visual structure of a government ID are much harder to replace.
It strengthens impersonation
A clear front-and-back image can make account-opening fraud, account-recovery abuse and highly convincing social engineering easier—especially when combined with data from other breaches.
It crosses systems
Licenses are used by banks, rentals, age-verification systems, insurers, telecom providers and government services. One retained scan can outlive the transaction that collected it.
The lesson
Organizations should stop treating a full identity-document image as harmless paperwork. Collect less, retain it for less time, and make every processor prove where copies go.
What U.S. readers should do now
Freeze all three credit files
The FTC says a credit freeze is free, does not affect your credit score, lasts until you lift it, and must be placed separately with Equifax, Experian and TransUnion. A freeze blocks new-credit access; it does not clean up an account already taken over.[5]
Review credit and financial activity
Look for unfamiliar inquiries, accounts, password-reset messages, phone-number changes and bank-profile changes. Use official apps or manually typed addresses—not links in breach-alert emails.
Add a fraud alert if appropriate
The FTC says an initial fraud alert is free, lasts one year and requires contacting only one nationwide credit bureau; that bureau must notify the other two. You can use a fraud alert alongside a freeze.[5]
Contact your licensing agency—especially if misuse appears
IdentityTheft.gov says people whose driver-license information was exposed should contact their DMV; the state may flag the number or recommend a duplicate. If identity theft has occurred, create a recovery plan at IdentityTheft.gov.[6]
Lock down the recovery channels
Secure your primary email, mobile-carrier account and financial accounts with unique passwords and phishing-resistant MFA or passkeys where available. Criminals holding an ID image may still need your email or phone channel to complete an account takeover.
Expect “breach help” scams
Do not pay anyone who claims they can remove your license from the dark web, and do not send a second ID copy to an unsolicited caller. Verify any notice through the company’s independently located website or phone number.
Florida-specific steps
FLHSMV says that if your Florida driver-license or ID-card number was compromised or found on a dark website, start by making a local police report when you are a victim of identity theft. The agency says a Florida driver-license number generally cannot be changed unless there is a name change, but it can place a Verify ID Flag on a Florida driver record to make impersonation harder. Follow FLHSMV’s own process; do not assume buying a routine replacement card changes the underlying number.[7]
Canadian readers and businesses
The Canadian Anti-Fraud Centre warns that stolen personal information can be used to seek government benefits, open credit or bank accounts, obtain mobile service, take over online accounts and pursue other fraud. Canadians should monitor financial activity, secure accounts and report actual fraud through official Canadian channels.[8]
Business response checklist
- Inventory every vendor, device and API that scans or stores identity documents.
- Ask processors in writing whether your environment or customer records are implicated; do not treat silence as clearance.
- Preserve logs and access evidence before rotating or deleting anything.
- Disable unnecessary retention and export paths, then rotate exposed integration credentials if evidence warrants it.
- Prepare legally reviewed notices based on verified scope—not a criminal marketplace’s headline number.
What remains unknown
- Whether IDScan.net was breached and, if so, by what method.
- Whether the full advertised inventory was authentic, current or duplicated.
- How many unique individuals, businesses, states or provinces are affected.
- Whether sensitive images were copied elsewhere before Nexus disappeared.
- Whether affected people will receive official notices or monitoring services.
- Whether a safe, authoritative way to check individual exposure will be created. There is no reason to visit a dark-web market or pay for a lookup.
Taking a criminal service offline is good. Pretending copied identity documents vanished with its login page would be dangerously naïve. Freeze what can be frozen, harden what can be hardened, and wait for verified notices—not rumor-driven panic.
Sources
- KrebsOnSecurity — “FBI Probes Service Selling 153M+ Drivers Licenses” (Sept. 1, 2026).
- Reuters — “FBI probes report that data breach exposed millions of US drivers’ licenses” (Sept. 2, 2026).
- TechCrunch — “It sure looks like hackers breached a major ID card verification service” (Sept. 2, 2026).
- CBS News — “Hack exposes more than 150 million U.S. and Canadian driver’s licenses on dark web” (Sept. 3, 2026).
- Federal Trade Commission — “Credit Freezes and Fraud Alerts”.
- IdentityTheft.gov — “Deal With a Data Breach”.
- Florida DHSMV — “Identity Theft & Driver License Fraud Protection”.
- Canadian Anti-Fraud Centre — “Identity theft and fraud”.
- The Intel Desk — “195M Identity Records Claimed for Sale as Nexus Driver’s License Dataset Resurfaces on Dark Web” (Sept. 6, 2026). This is the public origin we found for the new resale allegation; its description and on-screen graphic label the claim unverified, and neither authenticates the depicted forum post or dataset.
Editorial standard: criminal claims are labeled as claims; suspected attribution is not presented as confirmed; recommendations are practical guidance, not a guarantee against fraud.