FBI Probes Dark-Web Nexus Service Selling 153M Driver's License Scans

The FBI has opened an investigation into a dark-web identity theft service called Nexus that was offering digital scans of more than 153 million US and Canadian driver's licenses for sale. The New Orleans field office of the Federal Bureau of Investigation launched an official inquiry into the source of the images.

What Nexus was selling

On Nexus, visitors could find over 153 million driver's licenses, more than 10 million identification cards, over 3 million travel documents and international IDs, and roughly 580,000 medical cards. Only around 1.1 million driver's licenses were from Canada.

The criminals reportedly obtained digital images of government-issued identification documents, including front-and-back scans and, in some cases, the infrared and ultraviolet images used to authenticate them. Over the past 24 hours, the number of records listed as available in Nexus increased by nearly 400,000, suggesting that freshly stolen license data is being harvested and uploaded to this service on a semi-regular basis.

The trail leads to IDScan.net

Based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana. The FBI's New Orleans field office has opened an investigation into an apparent breach involving identity verification provider IDScan.net.

IDScan.net advertises that its technology processes more than 21 million identity verifications every month at over 20,000 locations worldwide. There are indications suggesting that at least some of the data was stolen from a verification service used by rental car company Hertz.

Do you want to see how to make more plays? Do you want to find gains yourself?

Unusual Whales helps you find market opportunities through our market tide, historical options flow, GEX, and much, much more.

Create a free account here to start conquering the market with Unusual Whales.

High-profile names in the trove

A record available at the identity theft service includes the driver's license for U.S. Defense Secretary Pete Hegseth, one of several high-ranking U.S. government officials whose driver's licenses can be found for sale. Some of the driver's licenses the threat actor behind Nexus had exfiltrated apparently belong to FBI agents.

According to Krebs, the Nexus platform was shut down shortly after his article on the stolen IDs was published. However, the FBI apparently caught wind of the potential IDScan data breach and launched an official investigation into the matter.

Why traders should care

Identity-verification vendors sit inside the plumbing of rental cars, dispensaries, financial onboarding, and travel. A breach at that layer creates downstream liability for every enterprise customer that relied on it, and could accelerate spend on cybersecurity, fraud detection, and identity re-verification.

Watch for enterprise customers named in reporting to disclose exposure, and for cyber names to catch a bid on any headline follow-through. For more market news, keep an eye on the tape.

Options market and stocks to watch

Watch for reaction across cyber, identity, and any names tied to the reported customer list:

• HTZ — Hertz has been flagged as a possible collection point for some of the exposed scans; watch for headline risk and any company response.
• CRWD — CrowdStrike could see flow as institutions review identity and endpoint exposure.
• PANW — Palo Alto Networks is a common beneficiary of large breach headlines; watch for defensive positioning.
• OKTA — Okta sits in the identity stack; watch for sympathy moves as buyers scrutinize identity vendors.
• ZS — Zscaler is another cyber name that tends to move on breach news cycles; watch options flow.

Want more market intelligence? Create your free Unusual Whales account for options flow, market tide, GEX, and the full toolkit.