On September 3, 2026, KrebsOnSecurity published a piece that changed the conversation around "show us the document, and we'll let you in" forever. A service called Nexus was operating on the dark web, and its catalog contained over 153 million scans of driver's licenses from residents of the USA and Canada, around 10 million ID cards, 3 million travel documents, and 579 thousand medical records — totaling documents from more than 170 million people. Krebs identified IDScan.net from New Orleans as the source of the data — a contractor for identity and age verification. The FBI's field office in New Orleans has opened an investigation, and Nexus has gone offline.
The most troubling aspect of this story is not the volume of data, but rather that the leak was live.
What Exactly Happened
Nexus was advertised on the Russian-speaking cybercriminal forum Exploit. In a promotional post, the operators stated that they had been "continuously uploading new data to their private database for over a year." This was confirmed by the service's behavior: the database was updated in real-time — during a single day of observation, about 400 thousand new records were added. This was not a one-time dump, but a channel that had been broadcasting every scan as it appeared for over a year.
The contents of the records also differ from the usual "username-password":
- images of the document from the front and back;
- infrared and ultraviolet versions of the scan — the very ones used to check security features;
- timestamps that coincide with real events in the owner's life — car rentals, trips, purchases.
Records could be previewed before purchase — with partially obscured fields, like items in a store window. According to Techdirt, among those whose data was included in the database was a document belonging to the current US Secretary of Defense.
Krebs traced the source through his own lead: his scan in the database matched a car rental from June 2025. Among the clients of IDScan.net are publicly named Hertz, Target, FedEx, Motorola Solutions, Caesars Entertainment, and the financial company Jack Henry, as well as cannabis dispensary chains — in particular, Planet 13, which signed an exclusive verification agreement with IDScan in 2022. At the time of publication, the company had not provided any official comments, and its Trust Center page with promises of data protection and compliance with GDPR/CCPA remained unchanged. Law firms have already begun gathering materials for a class-action lawsuit.
Why This is a Fundamentally Different Class of Leak
We regularly discuss password leaks — there is a clear procedure for them: change it, enable 2FA, forget it. We examined this in the context of a compilation of 24 billion account records and the mechanics of credential stuffing. The problem with document scans is that there is no "change" button.
Your date of birth does not rotate. The face in the photo does not rotate. Your address changes every few years and not at your discretion. The ID number is only reissued along with the document itself, through a government procedure, and the old scan does not disappear — it remains a valid confirmation of what you looked like, where you lived, and when you rented a car. High resolution plus IR/UV layers make such a scan suitable not only for account opening fraud but also for passing someone else's automated verification: the system on the other end sees exactly the same authenticity indicators as the original scanner.
From this, a simple rule to keep in mind emerges: the network layer is reversible, the document layer is not. An IP address, cookies, browser fingerprint — all of this can be changed in a minute, and the cost of an error is limited. A scan of a passport or driver's license given to a dubious service is an irreversible action with unlimited consequences.
This is Not a One-Off Contractor Failure, It's a Model
IDScan.net is not the first case, but the third notable one in a year, and all three fit into a single pattern: data leaks not from the platform itself, but from its verification contractor.
- Discord / 5CA (October 2025). Through a compromised support agent account, attackers gained access for about 58 hours. Discord officially reported the theft of at least 70 thousand images of government IDs used for age verification; the group Scattered LAPSUS$ Hunters claimed a significantly larger volume and demanded a ransom, lowering their request from 5 to 3.5 million dollars. Discord refused to pay, and 5CA disputed their version.
- Persona (February 2026). Researchers reported an open frontend of a contractor for age verification, which also serviced Discord.
- IDScan.net (September 2026). A year of continuous data dumping, 170+ million people, FBI.
The logic is the same everywhere. The platform is required to verify age or identity, building this internally is expensive and risky — so verification is outsourced. The contractor aggregates documents from hundreds of clients, becoming a single point of failure of a scale that no individual site can match. After that, just one compromised support account, a forgotten endpoint, or unrevoked access is enough — and not just one service's database leaks, but a slice of documents from an entire country.
Regulatory pressure only tightens this knot. Age verification requirements are expanding — we discussed how age verification laws are driving demand for VPNs and proxies. Each new such law means more platforms collecting scans, more contractors in the chain, and more copies of your document in places you never chose.
Where This Should Technically Move
Digital identity experts commenting on the incident point to an obvious solution: as long as verification boils down to transmitting an image of the document, any chain of processors remains a collection of archives ready for theft. The alternative is mobile driver's licenses (mDL) and cryptographic schemes, where the verifying party receives not a scan, but a signed assertion: "the holder is over 18," "the document is valid, issued by such-and-such authority." The image itself does not leave anywhere and, accordingly, cannot leak.
The difference between the two models is clearly visible in the Nexus example. In the file transmission scheme, a leak gives the attacker a reusable asset: a scan with IR/UV layers passes automatic verification with the next operator just like the original. In the scheme with a signed assertion, there is nothing to steal — the confirmation is tied to a specific request and is useless outside of it. The problem is that the transition hinges not on technology, but on infrastructure: mDLs are not supported in all jurisdictions, not all terminals, and almost no online platforms, while regulatory requirements are already in effect. Therefore, in the coming years, verification will rely on scans, and the number of aggregator contractors will grow faster than their maturity in security.
Hence, the only protection available to users right now is to reduce the number of places where the document ends up. Not "protect your scans" (you don't control them after sending), but avoid creating unnecessary copies.
What to Do About This Practically
It won't be possible to completely abandon document verification — banks, telecom operators, and official rentals will legally require it. But between "must" and "used to" lies a huge gray area, and that's where documents get lost.
- Separate requirements by strength. For legal requirements (bank, notary, government service) — you provide them. For platform requirements "to unlock a feature" or "to confirm you are human" — first look for alternatives: confirmation via card, phone number, or age range without disclosing the document.
- Ask who exactly is receiving the file. The interface shows the name of the platform, but the scan almost always goes to a contractor. If the policy does not name the processor and the retention period — you don't know where you are placing the document.
- Don't solve problems with documents that can be solved at the network layer. A large share of requests for "confirm identity" arises because your traffic looks suspicious: foreign region, datacenter IP, a dozen accounts from one address. This can be fixed with residential proxies and careful profile isolation — that is, at the reversible level, before the system reaches the document requirement.
- Consider the lifespan of the risk. A leaked password is dangerous until it is changed. A leaked scan of rights is dangerous until the document expires — and for some time after, while your data remains relevant. Plan disclosures with this horizon, not "for today."
- Check where your documents are already stored. Car rentals, car-sharing, dispensaries, hotels, crypto exchanges, support services where you once sent a photo of a document in chat. Where there is a deletion procedure — use it. A file in support correspondence lives as long as the correspondence itself.
Conclusion
The story of IDScan.net is interesting not for its record, but for the genre shift: it was not a hack that worked for a year, but a subscription to a stream of other people's documents. The verification industry is built on the assumption that a centralized contractor will protect data better than each platform individually — and this assumption has failed the test three times in a year. Until the industry transitions to cryptographic schemes, where the fact ("over 18," "document valid") is verified without transmitting the image itself, every uploaded scan should be considered transmitted forever and to an unknown number of parties.
The practical takeaway for those working with multiple accounts and platforms is simple: keep the problem at the level where the error is reversible. IP, fingerprint, profile — these can be changed. The document — cannot.