A dark-web marketplace that surfaced in late August has claimed access to approximately 170 million records, including over 153 million U.S. and Canadian driver's licenses, 10 million other IDs, 3 million travel documents, and at least 579,000 medical cards. According to operators, the information was gathered over more than a year from a major identity verification company.
Cybersecurity expert Dr. Marilyne Ordekian told Bitcoin.com News that the Nexus breach is far more dangerous than a standard password dump. While compromised passwords can be changed, government identifications contain permanent personal details such as photographs, home addresses, and dates of birth.
What sets the Nexus breach apart is the reported inclusion of infrared and ultraviolet scans. Ordekian noted that these scans are security measures used to authenticate physical documents, meaning criminals potentially hold the technical layer used to prove an ID is genuine. This turns any ID-gated system—such as opening bank or cryptocurrency exchange accounts, renting cars, or verifying wire transfers—into a potential attack surface.
Beyond digital identity theft and money laundering, experts highlighted physical security risks. Ordekian pointed out that crypto users identified through data breaches have previously been targeted physically for their assets, while domestic violence survivors and individuals in witness protection programs could also be endangered.
The trail has pointed toward New Orleans-based identity verification provider IDScan.net, which processes over 21 million identity checks monthly. While IDScan has not formally confirmed a breach, it informed customers that it was investigating potential data exposure.
Artem Popov, head of fraud prevention products at Sumsub, stated that storing personal data carries inherent risks for any business handling it. He emphasized that document photos alone should never suffice for onboarding users, noting that social engineering often plays a role in data leaks.
To mitigate these risks, experts advocate for multi-layered identity verification. Popov suggested implementing a second factor, such as liveness detection, to confirm that a real person is physically present. However, Popov cautioned that biometrics also introduce permanent risks, as biological identifiers cannot be reissued if compromised.
The FBI investigation into the incident remains open, proposed class actions have been filed, and IDScan has yet to release a full forensic account.
