I rented a car, and within hours, my driver's license was for sale

Details

KrebsOnSecurity has uncovered Nexus, a dark web ID theft service selling high-resolution driver's license scans at a rate of roughly 400,000 new records per day. The scans include standard images plus infrared and ultraviolet captures — formats that could allow counterfeit IDs to pass hologram verification and defeat standard fraud checks. Evidence points to IDScan.net, a New Orleans-based identity verification company with exclusive arrangements at Planet13 dispensaries and confirmed relationships with Hertz and at least 11 other businesses. The breach appears to be ongoing, with compromised records typically appearing within hours of the physical ID being scanned at a business — suggesting active access to data flowing through IDScan.net's systems. Records identified include Common Access Cards (government-issued building access IDs), marijuana dispensary cards, and commercial driver's licenses alongside standard driver's licenses. IDScan.net says it is investigating. For AI practitioners building identity verification, KYC, or document scanning systems, this incident illustrates the critical risk of centralizing biometric scan data through third-party intermediaries at scale.