The ID Verification Company Meant to Stop FraudJust Became a Fraud Factory

Author: Stephen Engler, Owner of Ctrl-Alt-GenX and cybersecurity speaker (@PHtheAdmin)

If you've rented a car from Hertz, bought something at Target with an ID check, walked into a special botanical retail store, or verified your identity at more than 20,000 locations worldwide, there's a decent chance your driver's license just showed up for sale on a Russian cybercrime forum.

Here's the story, and it's a good one, because the way it got uncovered says as much about human persistence as it does about the hack itself.

What Happened

On August 31, a dark web identity theft service called “Nexus” launched on a Russian cybercrime forum. It advertised access to more than 170 million identity documents belonging to people across the US and Canada. Break that number down and it gets worse: roughly 153 million driver's licenses, 10 million ID cards, 3 million travel documents, and about 579,000 medical cards, including cards from special botanical retails. The database was still growing when it was discovered, nearly 400,000 new records showed up in a single 24-hour window, which means the data may have still been actively flowing in.

The source traced back to IDScan.net, a New Orleans identity verification company. If you've never heard of them, you've probably still interacted with their technology. They scan IDs using infrared and ultraviolet imaging, the same methods banks and government agencies use to confirm a document isn't forged. They handle over 21 million verifications a month at more than 20,000 locations, with clients including Hertz, Target, FedEx, Motorola Solutions, Jack Henry, Caesars Entertainment, and more than 1,000 special botanical retailers across 19 states.

How Brian Kerbs Cracked It

This part is worth slowing down for, because it's genuinely good reporting. Krebs got a tip that his own Virginia driver's license was sitting on Nexus as a free sample. Instead of just writing that up, he asked about a dozen friends and family members for permission to search for their information too. Nine of them turned up. Then he started matching timestamps. His own scan was dated to a June 2025 trip he took for a family funeral, and it lined up exactly with a Hertz rental from that trip. His mother's license had two scans just seconds apart, both during that same rental. A researcher named Zach Edwards found his license timestamped to a DEFCON trip in Las Vegas, matching a visit to the retail store, Planet13. Another researcher's license matched a Hertz rental during his own vacation.

That pattern, Hertz rentals and special botanical retail visits lining up with scan timestamps, is what pointed straight at IDScan.net as the common thread. One more detail seals it: Krebs never showed a physical license at the airport that trip. He used his passport instead, since he doesn't have Real ID. His license still turned up in the leak anyway, because it was the rental car company, not the airport, doing the scanning.

Why This Breach is Different

A stolen driver's license number is bad. A stolen license number with six matching image files, front, back, a basic scan, and separate infrared and ultraviolet captures, is a different problem entirely. States embed security features that only show up under IR or UV light specifically so verification systems can catch forgeries. With the full set of scans in hand, someone has what they'd need to build a convincing forgery that passes the very checks meant to catch fakes.