153 million driver's licenses for sale trace to an ID scanner

A listing on the Exploit forum called "Nexus" is selling 153 million US and Canadian driver's licenses, more than 10 million ID cards, and over 3 million travel documents. KrebsOnSecurity reported September 1 that the FBI is now probing idscan.net, an ID-verification vendor, as the apparent source, per KrebsOnSecurity's report.

The timestamps in the records match ID scans taken at car rental counters and cannabis dispensaries, the kind of everyday age or identity check most people hand over without a second thought. Some entries include infrared and ultraviolet scan variants, the layers a scanner captures to check a license isn't forged. That's not a password dump. It's the raw material for building a fake ID good enough to pass the same kind of scanner that created it.

Researcher Larry Baldwin's warning is the sharper point: run AI image matching against a corpus this size and you can locate specific people, including domestic violence survivors and witness protection participants, by matching a face to a scan tied to a real-world location and date. A stolen password gets rotated. A face and a license number don't.

The report doesn't say how many records the FBI has verified as genuine idscan.net data, or whether the vendor has confirmed a breach. It also doesn't say how long the listing was up before anyone caught it. If verification vendors are holding UV-scan archives with no stated retention limit and no public disclosure requirement, this won't be the last one to turn up on a forum.