Episode Details

A dark web shop, 153 million driver's licence scans, an FBI investigation, and the scanner at your front desk.

What was found. On 1 September, KrebsOnSecurity reported a dark web service called "Nexus" advertising more than 153 million US and Canadian driver's licence scans, plus 10 million+ ID cards, 3 million+ travel documents and 579,000+ medical cards. Records contained six images per document — front and back in normal, infrared and ultraviolet light — with date and time stamps. The listing appeared on a Russian-language forum on 31 August. The FBI's New Orleans field office opened an investigation the day Krebs published and confirmed it publicly to Reuters on 2 September. The Nexus site went offline hours after publication. Four class actions were filed on 2 September in the US District Court for the Eastern District of Louisiana.

The important qualifier. The lawsuits name identity-verification vendor IDScan.net, but the company has NOT confirmed a breach. It says it is working to validate the information, has not reached conclusions on the nature or scope of any incident, and has secured systems, preserved logs, engaged outside counsel and forensics, and contacted law enforcement. Krebs's evidence is correlative: he found his own licence and nine of a dozen consenting volunteers' licences, and every timestamp matched a moment the person handed a licence to a business — usually a car rental counter. IDScan.net's documentation describes infrared and ultraviolet document scanning, matching the image types in the dump. Compelling, but not proven.

A correction worth noting. Early coverage listed brands from IDScan.net's public customer page. Caesars Entertainment stated on 2 September that it has not been a client, stopped using the relevant product in February 2025, had no active accounts at the time, and did not authorise data retention.

Also unknown: when collection began (the "over a year" claim comes from the seller's own advertisement), and whether the dataset still circulates. There is no legitimate service where an individual can check exposure.

What Australian businesses should do. If you photograph or scan customer ID — real estate, recruitment, RTOs, conveyancing, gyms, venues, car hire, AML checks — this is your risk profile. Four questions: (1) Do you still hold documents you no longer need? Australian Privacy Principle 11.2 requires destruction or de-identification once the permitted purpose has passed. (2) If you use a third-party verification product, where is the image stored, for how long, and what do your contract terms actually say about retention, deletion on termination, sub-processors and breach notification? (3) Could you record a verification event instead of keeping an image? (4) If your ID store were breached tomorrow, could you say how many documents, whose, and how old?

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: KrebsOnSecurity; Reuters; BleepingComputer; SecurityWeek; CSO Online; TIME; OAIC (Australian Privacy Principle 11).