# How a routine car rental put 153 million driver's licenses at risk

> A massive dark web leak exposing multi-spectrum ID scans reveals serious vulnerabilities in third-party identity verification systems.
- Title: How a routine car rental put 153 million driver's licenses at…
- Summary: A massive dark web leak exposing multi-spectrum ID scans reveals serious vulnerabilities in third-party identity verification systems. Commercial ID scanning…
- Keywords: cybersecurity, identity theft, dark web, privacy, data breach, technology, science, routine, car, rental, put, 153
- Source: Ars Technica — https://arstechnica.com/security/2026/09/my-drivers-license-is-one-of-153-million-for-sale-on-a-new-dark-website
- Read time: 1 min
- Topics: cybersecurity, identity theft, dark web, privacy, data breach, technology, science
## Rental scan lands on dark web
Hours after scanning a driver's license at a car rental counter, high-resolution images of the ID were posted for sale on a dark web marketplace called Nexus.

> Within hours of an employee scanning my driver’s license, a high-resolution scan of my ID was available for sale on the dark web.
## Millions of IDs exposed with spectrum scans
Nexus offered over 153 million identity documents. The leaked files included infrared and ultraviolet scans designed to help counterfeit IDs bypass hologram tests.

> Besides a basic image scan, the files also captured the images in the infrared and ultraviolet spectrums.
## Real-time leakage feeds massive growth
The dark web platform grew by nearly 400,000 licenses in a single day. Recent customer scans appeared online within hours, indicating an active breach harvesting fresh data.

> Over a span of 24 hours, Krebs said the number of driver’s licenses listed as available grew by almost 400,000.
## Scanning vendor linked to breach
Evidence points to third-party verification providers like IDScan.net, a service used by major rental companies and dispensaries that explicitly captures multi-spectrum ID scans.
## Service goes offline amid investigation
Nexus went dark shortly after the security report was published, and federal law enforcement has launched an investigation into the massive data leak.

> Nexus went dark within hours of the KrebsOnSecurity scoop, although that also means there’s no way for people to check if their IDs are included.
## Key takeaway

Commercial ID scanning services can be compromised in real time, placing detailed identity data and physical counterfeit-bypassing scans onto the dark web.