153M licenses for sale on Nexus as UV/IR ID scans leak from Hertz, Planet13

For cybersecurity teams, the Nexus case is a live-fire lesson in third-party scanner compromise and enhanced-ID data leakage. The near-real-time appearance of scanned licenses—within hours of being captured at rental counters—means defenders must treat ID scanning vendors as high-value targets and their data pipelines as potential continuous exfiltration channels.

On September 2, 2026, Ars Technica security journalist Dan Goodin reported a disquieting personal confirmation of a massive identity-theft operation. Shortly after renting an SUV from a well-known car rental company, he found that a high-resolution scan of his driver's license was available for purchase on Nexus, a dark web ID theft service. The service, exposed by Brian Krebs of KrebsOnSecurity on September 1, listed more than 153 million driver's license records, including what were purported to be multiple image files for each identity: front and back scans plus captures in the infrared and ultraviolet spectrums. That imaging depth matters because counterfeiters can use UV/IR captures to replicate the physical security features that many bouncers, banks, and government checkpoints rely on to spot fakes.

“

IDScan.net had announced an exclusive arrangement with Planet13 and listed Hertz and 11 other companies as using its services.

Krebs's investigation showed this was not a static database dump. Over a 24-hour period, the number of listed licenses grew by almost 400,000, a strong sign that Nexus had continuous, near-real-time ingestion from some upstream source. Nexus also advertised other credential types, including records labeled 'CDL,' which may be shorthand for commercial driver's license, and 'CAC,' which may refer to Common Access Cards issued to government personnel. It even offered marijuana dispensary card scans. One victim told Krebs that after visiting a Las Vegas outlet of Planet13, a multi-state dispensary chain, their license appeared on Nexus shortly after. Goodin's own rental-car license appeared within hours. That temporal correlation points directly at the third-party scanning service used at those physical locations.

Public records and prior announcements point to IDScan.net, a New Orleans-based ID scanning company. IDScan.net had announced an exclusive arrangement with Planet13 and listed Hertz and 11 other companies as using its services. Its own documentation states that its scans capture both infrared and ultraviolet spectra, matching the file types offered by Nexus. IDScan.net said it was investigating and did not immediately answer detailed questions. Hertz and Planet13 also did not immediately respond. The FBI has an ongoing investigation. The fact that a common third-party OCR/scanning vendor is the suspected source makes this a classic supply-chain compromise: the businesses themselves may not have been breached, but their customers' credentials flowed through an intermediary that either was compromised or had a malicious insider.

For security leaders, this breach is a case study in third-party risk specific to identity document processing. Rental car counters, dispensaries, and other age- or identity-verifying businesses create high-volume, low-friction scanning environments. They are often staffed by low-wage workers, use commodity scanning hardware, and send images to centralized cloud services. If that cloud service is compromised, every scan can be exfiltrated in real time. The addition of infrared and ultraviolet capture raises the stakes: most privacy laws require notification when driver's license data is exposed, but the physical security implications of UV/IR templates are less well addressed. Organizations may need to reassess whether they truly need to capture and retain UV/IR images, or whether visible-light scans suffice for compliance.