There Is No Secure Identity: What 153 Million Stolen Driver's Licenses Tell Us

A dark web service sold license scans taken from the company paid to verify them. The lesson: static identity is finished, and no single identity signal is secure on its own.

The Breach That Verified Everyone

In early September 2026, KrebsOnSecurity reported that a new dark web service called Nexus was selling scans of more than 153 million U.S. and Canadian driver's licenses, and that the FBI's New Orleans field office had opened an investigation.¹ Brian Krebs traced the data to IDScan.net, a Louisiana company that verifies IDs for rental counters, retailers, hotels, and more than 1,000 cannabis dispensaries.¹

The inventory went beyond licenses. Nexus also claimed more than 10 million ID cards, over 3 million travel documents, and at least 579,000 medical cards, with some records tagged "CDL" (commercial licenses) and "CAC" (possibly Common Access Cards).¹ Each record reportedly carried six images: front, back, a basic scan, and infrared and ultraviolet captures, stamped with the moment the card was handed over.¹

Rank offered no protection. Krebs found licenses belonging to several senior U.S. government officials for sale, including Defense Secretary Pete Hegseth.¹

That timestamp detail is the part worth sitting with. Krebs confirmed the source partly because people's timestamps matched the second they slid their license across a Hertz counter.¹ The system built to prove identity became the system that leaked it, and it did so at the exact moment people were doing the "secure" thing.

Why This Data Is Worth More Than a Password Dump

A stolen password expires the day you reset it. A stolen license scan stays useful until the card is reissued, often years later. Krebs notes that driver's licenses are a primary proof of identity for opening lines of credit, and that exposed records can put domestic violence survivors and protected witnesses at risk through facial recognition matching.¹

Three things make this dataset different from a typical breach:

• It is verification grade. Most fraud kits ship a photo of a card. These records reportedly include the infrared and ultraviolet captures that scanners use to confirm a card is genuine, which is the evidence a checker expects to see.¹
• It is searchable at scale. Krebs reported a blank search returned roughly 11.5 million pages of about 15 records each.¹
• It came from the trust layer itself. The seller claimed to have been "continuously exfiltrating new data for over a year."¹ If that claim holds, every scan at every client location kept feeding the stockpile.

Now stack that on the forgery market. In 2024, 404 Media reported a site called OnlyFake generating realistic ID photos for $15 each, and used one to pass identity verification at the OKX crypto exchange.² Nexus removed the hardest part of that pipeline: attackers no longer need to invent a convincing identity when they can buy a real one, already verified.

The economics have flipped. Defenders pay per verification, every time. Attackers paid once, by compromising one vendor that sat upstream of 20,000 locations.¹

Static Identity Is a Secret That Everyone Already Has

A driver's license was never designed to be a secret, yet most identity verification treats it like one. The logic of document based checks is simple: if you can produce this card, you must be this person. That logic holds only as long as the card and its images are hard to get. Nexus showed they are not.

This is the same lesson security learned with passwords, now applied to the physical world. Static identifiers share three weaknesses:

1. They can't be rotated. You can reset a password in a minute. You cannot reset your date of birth, your face, or your license number on demand, and reissuing millions of cards is not a realistic response.
2. They are copied every time they are used. Every scan at a rental counter, bar, or pharmacy creates another copy held by another vendor. Security researcher Zach Edwards told Krebs these systems are "putting sensitive data into more and more 3rd party vendors, and we don't have nearly the oversight to ensure they are safe."¹
3. They prove possession, not presence. A scan shows that someone held the data. It says nothing about whether that person is the one standing at the counter or sitting behind the webcam.

The uncomfortable part is that the industry was moving toward more document scanning, not away from it. Age verification laws, KYC rules, and fraud controls all push businesses to collect IDs. Cybera researcher Larry Baldwin put the irony plainly: just as authentication controls improved through license verification, "the very thing those improvements are dependent on are compromised."¹

We built a stronger lock around a key that was already being handed out.

Identity Is Becoming a Confidence Score, Not a Credential

The shift is already underway: identity is moving from a single check at the door to a running estimate of how confident we are that a person is who they claim to be.

Regulators and standards bodies have started to say so out loud. In November 2024, FinCEN warned financial institutions that criminals were using generative AI to create "fraudulent identity documents to circumvent identity verification and authentication methods."³ NIST's revised identity proofing guidance, SP 800-63A-4 (finalized August 2025), now requires providers to implement controls that "increase confidence that digital media is being produced by a genuine sensor," requires presentation attack detection for remote biometrics, and requires a formal fraud management program.⁴ Read together, the standard assumes submitted evidence may be forged and asks verifiers to prove otherwise.

Three developments are driving the change:

• Cryptographic credentials. Mobile driver's licenses and verifiable credentials let a verifier check an issuer's signature instead of inspecting a picture. NIST's guidance treats digital evidence as validated through "cryptographic verification of the source and integrity."⁴ Done well, the verifier never needs to store your license at all.
• Liveness and injection detection. With convincing faces now cheap, the question shifts from "does this face match the card?" to "is a real camera pointed at a real person?"⁴
• Continuous, risk-based checks. Signals such as device history, SIM swap indicators, and transaction patterns are now part of recommended fraud controls.⁴ Identity gets re-earned when the stakes rise, not proven once and trusted forever.

None of these is a cure. Phones get stolen, liveness checks get beaten, and behavioral models drift. The point is that no single one has to carry the whole weight.

There Is No Secure Identity, Only Managed Risk

If a vendor processing more than 21 million verifications a month can become the leak, then no identity signal is safe by itself.¹ The goal stops being "secure identity" and becomes identity that fails gracefully: when one signal is compromised, the system notices and the damage stays contained. This is zero trust applied to identity itself: no credential is trusted because it was valid once.

For security and identity teams, that looks like:

1. Stop storing what you only need to check. If you verify an ID to confirm age or match a name, keep the result, not the image. Every retained scan is future breach inventory.
2. Treat your ID verification vendor as critical infrastructure. Ask where images are stored, for how long, who can reach them, and how you would know if they were being copied. The Nexus seller claimed a year of quiet exfiltration.¹
3. Assume document evidence is compromised for high-risk actions. Opening credit, changing payout details, or resetting MFA should require signals beyond a card image, such as device binding, liveness, or a cryptographically signed credential.
4. Make identity continuous. Re-verify when risk changes, not on a calendar. A new device, a SIM swap, or an unusual transaction should lower confidence and trigger step-up checks.⁴
5. Build recovery into the design. Plan for how a customer proves they are the real owner after their identity data is sold, because for 153 million people that is now the starting condition.

For everyone else, the practical advice is smaller but real: freeze your credit, ask whether a business needs to scan your license or only look at it, and treat any unexpected account or loan notice as a sign your data is in play.

If you have shown your license at a rental counter, hotel, dispensary, or retailer that uses ID scanning, watch for a notice. IDScan.net said on September 8 that an unauthorized party may have accessed names and license or ID numbers, and it began notifying affected people and offering credit protection services.¹

The most difficult part about all of this, is as of this article publishing, there is no solution for those affected, and minimal knowledge of who is affected.

From "Prove Who You Are" to "Prove You're Still You"

For decades, identity meant showing a trusted object: a card, a number, a face that matched a photo. Nexus is a reminder that those objects are data, and data gets copied, sold, and replayed.

The next model of identity will be less satisfying and more honest. It won't promise certainty. It will ask for the least evidence needed, lean on signals that are hard to steal all at once, and keep checking as the stakes change. The organizations that adapt will be the ones that stop asking "is this identity secure?" and start asking "how would we know if it isn't?"

Sources

1. Brian Krebs, "FBI Probes Service Selling 153M+ Drivers Licenses," KrebsOnSecurity, September 1, 2026 (updated September 8, 2026). krebsonsecurity.com
2. Joseph Cox, "Inside the Underground Site Where 'Neural Networks' Churn Out Fake IDs," 404 Media, February 5, 2024. 404media.co
3. Financial Crimes Enforcement Network, "FinCEN Issues Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions" (FIN-2024-Alert004), November 13, 2024. fincen.gov
4. NIST, SP 800-63A-4, "Digital Identity Guidelines: Identity Proofing and Enrollment," part of SP 800-63-4, August 1, 2025. pages.nist.gov; publication record at nist.gov