Millions of Americans could be wondering whether their personal information is at risk after a massive cache of driver's license records allegedly surfaced on the dark web, triggering an FBI investigation and raising concerns about identity theft. The investigation centers on a dark web marketplace known as "Nexus," which claimed to offer access to more than 153 million driver's license records from the United States and Canada, as well as millions of other identity documents. Federal authorities haven’t yet confirmed the size of the exposure, but the allegations have already prompted legal action and heightened scrutiny of the identity verification industry.
The incident first came to public attention on September 1, after KrebsOnSecurity, an independent cybersecurity news outlet, reported the existence of Nexus, a platform advertising access to driver's license scans and other forms of identification. The service claimed to possess more than 153 million driver's license records, over 10 million ID cards, and millions of additional documents, including medical cards and travel documents. According to KrebsOnSecurity reporting, evidence suggested that the records being sold on Nexus may have been sourced from data collected by IDScan.net, a New Orleans-based identity verification company.
On September 4, IDScan.net publicly disclosed a data security incident, which was published by PR Newswire, stating: "On or around September 1, 2026, IDScan.net received information indicating that certain data may have been accessed without authorization." The company said an unauthorized third party may have accessed or copied customer information stored in cloud accounts. Potentially affected information includes names and driver's license or other government-issued identification numbers. IDScan.net said its investigation remains ongoing and that it is working with third-party specialists to determine the full scope of the incident.
The New Orleans FBI has confirmed it’s investigating the incident but has released few details. "The FBI can confirm that it is looking into the incident," the bureau told FreightWaves, adding that it could not comment further due to the ongoing nature of the investigation. Several proposed class-action lawsuits have also been filed against IDScan.net, alleging failures to adequately protect sensitive personal information.
At the time of publishing, the company hasn’t admitted any wrongdoing. While it’s not yet clear how many people were affected, experts generally recommend taking proactive steps whenever sensitive identification information may have been compromised. Regularly review your credit reports and financial statements for unfamiliar accounts, inquiries, or transactions.
Identity thieves can use personal information to open new accounts or apply for credit in someone else's name. Consumers can place a fraud alert on their credit file or freeze their credit with the major credit bureaus. A credit freeze can make it much harder for criminals to open accounts using stolen information.
Extract — continue reading at the source.
