# Nexus Leak: 153M-160M+ North American ID Records from IDScan.net Resold Across Dark Web Forums

> A dataset of 153M+ US/Canadian driver's license scans (160M+ North American IDs per DarkOwl) plus 10M+ other identity documents was offered via the 'Nexus' dark web service and traced by KrebsOnSecurity to identity verification vendor IDScan.net. IDScan disclosed possible, then confirmed, unauthorized access to its cloud environment on 2026-09-04; the data was later resold by 'databroker1' (Exploit), ShinyHunters (BreachForums), DarkForums accounts and Telegram channels.

- **Published:** 2026-10-16T00:47:54Z
- **Last reviewed:** 2026-10-16T00:47:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3685
- **ID:** TL-2026-3685
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-08-30/31 an Exploit forum post by the account 'databroker1' advertised the Nexus service, a searchable dark web platform selling scans of identity documents with free registration/search and per-record pricing. KrebsOnSecurity reported on 2026-09-01 that Nexus advertised 153M+ US and Canadian driver's license scans (about 152M US, about 1.1M Canada), 10M+ ID cards, 3M+ travel documents/international IDs and about 579,000 medical cards (including cannabis dispensary cards). Each license record reportedly held six images (front and back under visible, infrared and ultraviolet light, with a timestamp) plus barcode data. Krebs verified the data by searching consenting people's records and matching image timestamps to their travel and rental records, tracing the source to IDScan.net, a New Orleans-based ID verification vendor. Nexus was reportedly growing by about 400,000 records per day at the time of reporting. One report gives an access window of roughly 2026-04-04 to 2026-09-02; this comes from a secondary source.

IDScan.net (21M+ verifications monthly at 20,000+ locations; clients span car rental, retail, financial, cannabis, firearms and hospitality) published a security notice on 2026-09-04 stating an unauthorized third party may have accessed and/or copied customer information stored in its cloud environment, including full names and driver's license or other government-issued ID numbers. It engaged third-party specialists, offered credit monitoring and is cooperating with federal law enforcement. The FBI New Orleans field office opened an investigation. The initial access vector, the specific cloud service and the actor behind the intrusion have not been publicly disclosed.

After public exposure the original Nexus listing disappeared within days, and the Nexus onion address was inactive by 2026-09-14, but the data kept circulating. DarkOwl observed resales on BreachForums by ShinyHunters (asking $500,000, later $300,000), on DarkForums accounts ($6,000 up to $90,000) and in at least two Telegram channels (one later banned), plus a dedicated storefront separate from Nexus. Sellers listed claimed affected customers across retail, hospitality, automotive, finance and gaming, including Fortune 500 firms. DarkOwl stresses that these are criminal claims, that it has not independently confirmed the data came directly from IDScan, that a sample was authenticated by Krebs, and that sellers may exaggerate possession or scam other criminals. Attribution of the intrusion is unclear; the resellers are distribution personas, not confirmed intruders. Overlapping infrastructure and copied listing text link some personas.

Defender impact: exposed government ID images and numbers enable identity theft, synthetic identity and KYC fraud, fraudulent credit applications, account takeover via document-based recovery, and targeted phishing. Some exposed licenses reportedly belong to FBI agents. Organizations that used IDScan face downstream customer notification and legal exposure; litigation has been filed.

## MITRE ATT&CK

- T1078.004 Cloud Accounts
- T1530 Data from Cloud Storage
- T1119 Automated Collection
- T1585 Establish Accounts
- T1657 Financial Theft

## Sources

- [Inside the Nexus Leak - How a 160-Million-Record ID Database Spread Across the Dark Web](https://www.darkowl.com/blog-content/inside-the-nexus-leak/)
- [153 Million Driver License Images Offered on Dark Web - SecurityWeek](https://www.securityweek.com/153-million-driver-license-images-offered-on-dark-web/)
- [153M+ driver's licenses for sale on new dark web platform - Malwarebytes](https://www.malwarebytes.com/blog/news/2026/09/dark-web-site-puts-153-million-drivers-licenses-and-millions-more-ids-up-for-sale)
- [Dark Web Service Nexus Sells 153M+ Driver's Licenses - Security Affairs](https://securityaffairs.com/198388/security/dark-web-service-nexus-sells-153m-drivers-licenses.html)
- [IDScan confirms breach tied to 153 million stolen driver's licenses - BleepingComputer](https://www.bleepingcomputer.com/news/security/idscan-confirms-breach-tied-to-153-million-stolen-drivers-licenses/)
- [153 million driver's licenses exposed in suspected IDScan breach - CyberInsider](https://cyberinsider.com/153-million-drivers-licenses-exposed-in-suspected-idscan-breach/)
- [IDScan Confirms Breach: 153M IDs, Major Clients at Risk - Tech Insider](https://tech-insider.org/idscan-breach-confirmed-enterprise-clients-2026/)
- [Bank ID vendor traced to a dark web license sale - American Banker](https://www.americanbanker.com/news/bank-id-vendor-traced-to-a-dark-web-license-sale)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3685