A security researcher discovered his driver's licence, scanned during a routine car rental, was for sale on the dark web within hours—one of more than 153 million IDs listed on a new criminal marketplace called Nexus, according to an exposé by journalist Brian Krebs. The breach appears to stem from a third-party ID scanning service used by rental firms and other businesses, and its scale and near-real-time nature make it a particularly severe identity theft risk, prompting an FBI investigation.

The Nexus listings reportedly included high-resolution front and back scans captured in standard, infrared and ultraviolet formats, potentially sophisticated enough to help counterfeiters forge IDs that pass hologram checks. Victims named include Krebs himself, his mother, an FBI assistant director and several security researchers, while records also pointed to sources such as commercial driver's licences, government access cards and marijuana dispensary IDs. Krebs traced a likely link to IDScan.net, a New Orleans-based scanning provider whose clients reportedly include Hertz and a dispensary chain, and which said it is investigating; the number of exposed licences grew by nearly 400,000 in one 24-hour period before Nexus went offline shortly after the story broke.