InfoSecBulletin Cybersecurity for mankind
The FBI’s New Orleans field office has opened an investigation into the suspected source of more than 153 million driver’s licenses belonging to people in the United States and Canada. The service first surfaced on the Russian cybercrime site Exploit on August 31. It offered access to identity documents of over 170 million people in North America.
Nexus claimed its database included more than 153 million driver’s licenses, over 10 million other identification cards, more than 3 million travel and international identity documents, and at least 579,000 medical cards.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Driver’s License Scans Leak on Dark Web
Researchers looked at the service and said it had records from both countries. However, most of the database seemed to be from U.S. residents. They also found about 1.1 million Canadian driver’s licenses, with 473,673 records from Ontario.
The exposed material is said to include scans of licenses from both sides, plus infrared and ultraviolet images. These extra image layers matter because identity verification systems often use them to check security features and find fake IDs.
Some listings also included date-and-time information attached to image files, potentially showing when the document was scanned.
Several people found in Nexus had used their IDs while traveling or renting cars close to the times in the records. In one case, a researcher discovered that their own license scan was connected to a trip to a marijuana store.
Update, Sept. 2, 6:05 p.m. ET: A spokesperson for Caesars Entertainment said Caesars has not been a client of IDScan.net and has not used VeriScan since February 2025, despite IDScan.net listing them as a client on their website. That person said Caesars had no active VeriScan accounts at the time of the incident and did not authorize IDScan.net to retain data from its accounts, and that IDScan.net said the incident should have no impact on Caesars Entertainment.
Update, 8:56 p.m. ET: Shortly after this story was published, the Nexus identity theft service website vanished from the darkweb, replacing its login page with a plain text message that reads, “This service is no longer available.”
