InfoSecBulletin Cybersecurity for mankind
The FBI’s New Orleans field office has opened an investigation into the suspected source of more than 153 million driver’s licenses belonging to people in the United States and Canada. The service first surfaced on the Russian cybercrime site Exploit on August 31. It offered access to identity documents of over 170 million people in North America.
Nexus claimed its database included more than 153 million driver’s licenses, over 10 million other identification cards, more than 3 million travel and international identity documents, and at least 579,000 medical cards.
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Driver’s License Scans Leak on Dark Web
Researchers looked at the service and said it had records from both countries. However, most of the database seemed to be from U.S. residents. They also found about 1.1 million Canadian driver’s licenses, with 473,673 records from Ontario.
The exposed material is said to include scans of licenses from both sides, plus infrared and ultraviolet images. These extra image layers matter because identity verification systems often use them to check security features and find fake IDs.
Some listings also included date-and-time information attached to image files, potentially showing when the document was scanned.
Several people found in Nexus had used their IDs while traveling or renting cars close to the times in the records. In one case, a researcher discovered that their own license scan was connected to a trip to a marijuana store.
Update, Sept. 2, 6:05 p.m. ET: A spokesperson for Caesars Entertainment said Caesars has not been a client of IDScan.net and has not used VeriScan since February 2025, despite IDScan.net listing them as a client on their website. That person said Caesars had no active VeriScan accounts at the time of the incident and did not authorize IDScan.net to retain data from its accounts, and that IDScan.net said the incident should have no impact on Caesars Entertainment.
Update, 8:56 p.m. ET: Shortly after this story was published, the Nexus identity theft service website vanished from the darkweb, replacing its login page with a plain text message that reads, “This service is no longer available.”
