Investigative journalist, Brian Krebs went looking for himself on the dark weblast week and found his own Virginia driver's license being given away as a free sample.

The service is called Nexus. It went live at the end of August on a Russian cybercrime forum, and it sells scanned images of government IDs the way a grocery store sells produce. You search, you browse, you buy. To prove the goods were real, the proprietor handed Krebs his own license at no charge, front and back, the genuine article.

Then Krebs did what a good investigator does, which is check whether it was just him. He asked the people around him to search too. He found his mother's license in the catalog, and the timestamp on her scan sat a few seconds apart from his. He knew why. The two of them had stood at the same Hertz counter, one after the other, and handed over their licenses to rent a car. Nine of the nine people he asked to look found themselves, and every one of them could name the trip that matched the timestamp.

Nobody hacked a DMV. The images did not leak from the government office that issued them. They leaked from one of the private companies that businesses hire to check them.

What They Are Selling

Dark Web market Nexus listed more than 153 million US and Canadian driver's licenses (including the Fraudfathers'). On top of that, better than 10 million other ID cards, 3 million travel documents such as passports, and more than 579,000 medical cards. Run an empty search and it returned about 11.5 million pages of results. In the single day after Krebs found it, the catalog grew by almost 400,000 new licenses, which tells you the source was not a one-time dump. Something had been copying fresh scans off a live system for more than a year.

Where It Came From

The trail led to a company called IDScan.net, based in New Orleans. You have almost certainly never chosen to do business with them, and that is exactly the point. They are the software behind the counter. When you show your license to rent a car, buy age-restricted goods, or get into a casino, IDScan is often the system that reads it. The company says it runs more than 21 million verifications a month across 20,000 locations, and its published client list includes Hertz, Target, FedEx, Motorola Solutions, the banking-software firm Jack Henry, Caesars Entertainment, and more than a thousand marijuana dispensaries across 19 states.

The investigators worked backward from the timestamps. Krebs matched his scan and his mother's to that Hertz rental. A security researcher named Zach Edwards found his own record and matched it to a dispensary visit during a Las Vegas trip. Another researcher, Larry Baldwin, matched his to a rental car. The times were stored in GMT and stamped right into the filenames, which is how nine out of nine people could each point to the exact day their license was captured.

Caesars said it had not used the service since February of last year. IDScan acknowledged there was an investigation and said little else. The Nexus site itself went dark within hours of the story publishing, replaced by a single line: this service is no longer available. That is not the behavior of an operation that expects to be caught. It is the behavior of one that already got what it came for.

Worse Than a Password Breach

You have been trained to shrug at breach notices. A company loses your password, you change it, you move on. This is not that, and I want to be precise about why.

A few weeks back I told you about a man in Alabama whose own face was used to empty his bank account. This is the wholesale version of that story. A password is a fact about you that you are allowed to change. Your license number, your date of birth, your address history, and the photo of your face are facts about you that you cannot change on a Tuesday afternoon. Once they leak, they stay leaked.

Here is what a criminal does with a full front-and-back scan. Many online identity checks work by asking you to upload a photo of your ID and then take a selfie, and the software compares the two faces. That check was already weak. With an authentic high-resolution scan that carries the real security features, it gets weaker, because the fraudster is no longer submitting a homemade fake. He is submitting your actual document. Pair it with a stolen or AI-generated image of your face and he can open bank and crypto accounts in your name, take out loans, and clear the age and identity gates that are supposed to keep him out.

He can also build what the industry calls a synthetic identity, which stitches a real license number and date of birth onto an invented person. The result is a file that looks established and clean, with no history of fraud attached, which is precisely what a lender's system is trained to approve.

Field Manual

First, what to do as a person whose license is probably in that catalog. Then, if you build or run identity checks for a living, what this dump should change.