On Aug. 31, a new seller on Exploit, a Russian-language cybercrime forum, posted an offer for scanned identity documents covering more than 170 million people in North America, according to KrebsOnSecurity. The service, called Nexus, listed more than 153 million driver’s licenses from the United States and Canada, more than 10 million ID cards, more than 3 million travel documents and at least 579,000 medical cards. Brian Krebs, who broke the story Sept. 1, found his own Virginia license in the sales thread as a free sample. His record held six image files, the front and back of the card in a plain scan, in infrared and in ultraviolet, each stamped with a date and time. The stamp matched a June 2025 trip, and his mother’s license, handed across the same Hertz rental counter that day, was stamped seconds apart from his.

Krebs asked friends and family to search for their own records. Nine found their licenses, and each confirmed traveling on or near the date stamped on the images; several were tied to a Hertz rental. Researcher Zach Edwards traced his stamp to a Planet13 cannabis dispensary in Las Vegas during DEF CON, the one place on that trip he knew had run his card through a machine. IDScan.net lists Hertz as a customer on its own website and announced an exclusive verification deal with Planet13 in 2022. The FBI’s New Orleans field office opened an inquiry into an apparent breach at IDScan the same day Krebs published, and within hours Nexus replaced its login page with a notice that the service was no longer available.

IDScan posted a notice Sept. 4 saying it learned on or around Sept. 1 that data may have been accessed without authorization. The notice says an unauthorized third party may have accessed or copied customer information stored in the company’s cloud, including full names and driver’s license or other government ID numbers, and that full access to the information required payment. IDScan said it’s notifying people, offering free credit monitoring and cooperating with federal law enforcement. The notice doesn’t mention Nexus, and it doesn’t give a count. Twelve proposed class actions have been filed against IDScan.net Inc. in the U.S. District Court for the Eastern District of Louisiana, dockets 2:26-cv-01929 through 2:26-cv-01983, the first four on Sept. 2 and the latest two on Sept. 9. They’re allegations, and none has been decided.

The Federal Highway Administration counted 240 million licensed drivers in the U.S. in 2024. If every Nexus record were a unique American, that would be roughly six in 10. They aren’t: about 1.1 million records are Canadian, 473,673 of them from Ontario, some records repeat scans of the same card, and 153 million is the seller’s number. Krebs’s blank search of the database returned about 11.5 million pages at roughly 15 records a page, and the license count grew by nearly 400,000 in a single day, which Krebs read as fresh scans still coming in. Defense Secretary Pete Hegseth’s license was listed at $100, Cybernews reported, and an assistant director of the FBI was in the pile too.

The first week of coverage centered on rental counters and dispensaries. Krebs reported one detail that belongs to this industry: some Nexus records listed their source as “CDL,” which he read as commercial driver’s license, and others carried “CAC,” possibly the Common Access Card that gets federal personnel into secure government buildings. IDScan sells into trucking directly. It exhibited at the Mid-America Trucking Show in 2024, and its freight page pitches gate control, inbound driver check-in, and verification of IDs, CDLs, and TWIC cards at ports under the line “Never load cargo without first verifying your driver.” A 2026 IDScan case study describes one warehouse whose gate guards scanned more than 18,800 driver and visitor IDs and caught 23 fakes.

No public record shows which IDScan customers’ scans ended up in Nexus. Nothing ties the CDL-tagged records to a truck gate, and a CDL gets scanned as easily at a rental counter as at a dock door. What the tag does establish is that commercial licenses were in the pile, sorted and labeled as their own category. That much is measured, and the rest is my read.

A ghost driver is a real person’s license doing the paperwork while somebody else drives the truck. Every federal check on a driver keys on that license. The carrier builds the driver qualification file under 49 CFR 391.51 around motor vehicle records pulled from every state that licensed the driver in the prior three years. The Drug and Alcohol Clearinghouse query runs on the CDL number and issuing state, and each ELD driver account carries the same two fields. Every one of those checks comes back clean when the name on the card is clean, no matter who’s in the seat.

A scan adds the face and the card itself. The MVR and the Clearinghouse never see either one, and the gate guard and the onboarding app see both. Since April 2025, FMCSA, the Clearinghouse and a growing number of warehouse gates have moved to verifying identity with a document image checked against a live face, and the infrared and ultraviolet layers are part of how a scanner decides the card is genuine. The images Krebs found carry those layers. Larry Baldwin, a researcher at the security firm Cybera whose own license was in Nexus, told Krebs that “the very thing those improvements are dependent on are compromised.”

In early April 2025, FMCSA began requiring every new USDOT number applicant to pass identity proofing with a government ID and a face scan. On April 27, 2026, it added identity verification through IDEMIA for Clearinghouse employers, third-party administrators, medical review officers and substance abuse professionals, and said CDL holders are “already verified through state systems.” Starting May 14, 2026, FMCSA’s legacy registration systems gave way to Motus, and roughly 800,000 existing registrants have to clear document scans and facial recognition the first time they log in, with IDEMIA and CLEAR as the agency’s identity partners, CCJ reported.

In trucking right now, and everywhere else, identity is the key to everything. Chameleon carriers, double brokering, fictitious pickups and CDL mills all run on paper that says a person is someone they aren’t. Baldwin told Krebs the same images can open credit lines in a victim’s name and can expose people who can’t afford to be found, domestic violence survivors and people in federal witness protection among them, who can’t change their faces enough to beat modern image matching. Every identity check FMCSA has added since 2025 takes a state-issued license as proof of who you are, and Nexus put 153 million of them up for sale with the authentication layers attached.

For a carrier, a license image proves nothing about who’s holding it. Match the face live at hire and at the gate, and pull the MVR from the state yourself rather than accepting a copy the applicant sends. For a broker, a license photo emailed by a dispatcher doesn’t verify the driver who backs into the door. For a driver, IDScan’s notice lists fraud alerts and credit freezes at TransUnion, Experian, and Equifax, and the company’s notification line is 1-833-516-2980.