Threat reportData BreachTL-2026-3685
Nexus Leak: 153M-160M+ North American ID Records from IDScan.net Resold Across Dark Web Forums
Nexus Leak: 153M-160M+ North American ID Records from (TL-2026-3685), also tracked as Nexus Leak, is a high-severity data breach, first published 2026-10-16. It has no confirmed attribution, affects IDScan.net IDScan.net identity verification platform (cloud, maps to 5 MITRE ATT&CK techniques (T1078.004, T1119, T1530), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-3685
- Threat ID
- TL-2026-3685
- Also known as
- Nexus Leak, IDScan breach, Nexus ID marketplace
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- retail, hospitality, automotive, finance, gaming, cannabis, transport, police - law enforcement
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in Nexus Leak: 153M-160M+ North American ID Records from
Malware and tooling: Nexus, telegram
How Nexus Leak: 153M-160M+ North American ID Records from works
A dataset of 153M+ US/Canadian driver's license scans (160M+ North American IDs per DarkOwl) plus 10M+ other identity documents was offered via the 'Nexus' dark web service and traced by KrebsOnSecurity to identity verification vendor IDScan.net. IDScan disclosed possible, then confirmed, unauthorized access to its cloud environment on 2026-09-04; the data was later resold by 'databroker1' (Exploit), ShinyHunters (BreachForums), DarkForums accounts and Telegram channels.
On 2026-08-30/31 an Exploit forum post by the account 'databroker1' advertised the Nexus service, a searchable dark web platform selling scans of identity documents with free registration/search and per-record pricing. KrebsOnSecurity reported on 2026-09-01 that Nexus advertised 153M+ US and Canadian driver's license scans (about 152M US, about 1.1M Canada), 10M+ ID cards, 3M+ travel documents/international IDs and about 579,000 medical cards (including cannabis dispensary cards). Each license record reportedly held six images (front and back under visible, infrared and ultraviolet light, with a timestamp) plus barcode data. Krebs verified the data by searching consenting people's records and matching image timestamps to their travel and rental records, tracing the source to IDScan.net, a New Orleans-based ID verification vendor. Nexus was reportedly growing by about 400,000 records per day at the time of reporting. One report gives an access window of roughly 2026-04-04 to 2026-09-02; this comes from a secondary source.
IDScan.net (21M+ verifications monthly at 20,000+ locations; clients span car rental, retail, financial, cannabis, firearms and hospitality) published a security notice on 2026-09-04 stating an unauthorized third party may have accessed and/or copied customer information stored in its cloud environment, including full names and driver's license or other government-issued ID numbers. It engaged third-party specialists, offered credit monitoring and is cooperating with federal law enforcement. The FBI New Orleans field office opened an investigation. The initial access vector, the specific cloud service and the actor behind the intrusion have not been publicly disclosed.
After public exposure the original Nexus listing disappeared within days, and the Nexus onion address was inactive by 2026-09-14, but the data kept circulating. DarkOwl observed resales on BreachForums by ShinyHunters (asking $500,000, later $300,000), on DarkForums accounts ($6,000 up to $90,000) and in at least two Telegram channels (one later banned), plus a dedicated storefront separate from Nexus. Sellers listed claimed affected customers across retail, hospitality, automotive, finance and gaming, including Fortune 500 firms. DarkOwl stresses that these are criminal claims, that it has not independently confirmed the data came directly from IDScan, that a sample was authenticated by Krebs, and that sellers may exaggerate possession or scam other criminals. Attribution of the intrusion is unclear; the resellers are distribution personas, not confirmed intruders. Overlapping infrastructure and copied listing text link some personas.
Defender impact: exposed government ID images and numbers enable identity theft, synthetic identity and KYC fraud, fraudulent credit applications, account takeover via document-based recovery, and targeted phishing. Some exposed licenses reportedly belong to FBI agents. Organizations that used IDScan face downstream customer notification and legal exposure; litigation has been filed.
MITRE ATT&CK techniques used in TL-2026-3685
Initial Access
Collection
T1119 Automated Collection; T1530 Data from Cloud Storage
Resource Development
Impact
Affected products and versions in Nexus Leak: 153M-160M+ North American ID Records from
- IDScan.net — IDScan.net identity verification platform (cloud environment and customer data)
Vulnerable versions: Customer data stored in IDScan cloud environment, approx. 2026-04 to 2026-09 per secondary reporting
Remediation for Nexus Leak: 153M-160M+ North American ID Records from
Immediate actions
- If you are an IDScan customer, request written confirmation of whether your tenant's data was in scope and invoke your vendor incident clause
- Notify affected individuals as required by state/provincial breach laws and offer credit monitoring
- Treat government-ID-based identity verification as compromised for affected individuals: add step-up verification beyond document images for account recovery and KYC
- Monitor dark web forums, Telegram and marketplaces for your organization's data and customer records
Workarounds
- Individuals: place fraud alerts or credit freezes, monitor for fraudulent credit applications, and be alert to phishing that quotes ID details
- Individuals: consider replacing a license where the issuing jurisdiction permits
Longer-term hardening
- Minimize collection and retention of ID images; apply retention limits and purge scans after verification
- Prefer privacy-preserving age/identity verification that does not store document images
- Include third-party identity vendors in vendor risk reviews covering cloud access controls, logging and data segregation
- Do not rely on genuine-looking documents as indefinite proof of identity; add liveness and device/behavioral signals
Weaknesses (CWE) in Nexus Leak: 153M-160M+ North American ID Records from
Timeline of Nexus Leak: 153M-160M+ North American ID Records from
- Approximate start of the unauthorized access window to IDScan data, per secondary reporting (unconfirmed by IDScan)
- Initial Nexus posting by 'databroker1' on the Exploit forum
- A source alerts KrebsOnSecurity to the Nexus service advertised on Exploit
- KrebsOnSecurity reports Nexus selling 153M+ US/Canadian license scans and traces them to IDScan.net; FBI New Orleans opens an investigation
- IDScan.net publishes a security notice acknowledging unauthorized access to data in its cloud environment and offers credit monitoring
- Resales appear on BreachForums (ShinyHunters, $500K then $300K) and DarkForums ($6K to $90K) between Sep 5 and 6
- TechCrunch and BleepingComputer report IDScan's confirmation; lawsuits filed against IDScan
- DarkOwl confirms the Nexus onion address is inactive; data continues circulating on Telegram channels (Sep 6-14), one later banned
- DarkOwl publishes 'Inside the Nexus Leak' analysis of multi-platform resale
Sources cited for Nexus Leak: 153M-160M+ North American ID Records from
- Inside the Nexus Leak - How a 160-Million-Record ID Database Spread Across the Dark Web
- 153 Million Driver License Images Offered on Dark Web - SecurityWeek
- 153M+ driver's licenses for sale on new dark web platform - Malwarebytes
- Dark Web Service Nexus Sells 153M+ Driver's Licenses - Security Affairs
- IDScan confirms breach tied to 153 million stolen driver's licenses - BleepingComputer
- 153 million driver's licenses exposed in suspected IDScan breach - CyberInsider
- IDScan Confirms Breach: 153M IDs, Major Clients at Risk - Tech Insider
- Bank ID vendor traced to a dark web license sale - American Banker
Detection coverage for TL-2026-3685
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3685 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.