Overview
- This week independent reporter Brian Krebs published a dark-web listing called “Nexus” that advertised more than 153 million U.S. and Canadian driver’s license scans and posted verifiable sample records.
- Krebs and researchers confirmed sample images, including his own, and matched timestamps on many records to transactions processed by identity‑verification vendor IDScan.net, which says it is investigating but has not confirmed an intrusion.
- The Nexus marketplace went offline after the reporting, the FBI’s New Orleans field office opened an inquiry, and multiple law firms have filed or launched lawsuits and investigations naming IDScan.net.
- High-resolution front and back images plus infrared, ultraviolet and biometric data make impersonation, credit fraud and AI deepfakes easier and cannot be reset like passwords, so advisers urge people to contact their DMV, freeze or monitor credit, and place fraud alerts.
- The episode is likely to trigger prolonged litigation, regulatory scrutiny and industry pressure to limit retention of immutable ID images, echoing past large data incidents that produced multi-year enforcement and remediation efforts.