Nexus Dark Web Service Markets 153M+ Driver License Scans from Ongoing Louisiana ID Verification Breach

The service, advertised on the Exploit forum, offers records with timestamps matching real-world events such as travel dates and includes samples from high-profile figures including U.S. Defense Secretary Pete Hegseth. Record counts have grown by nearly 400,000 in 24 hours, indicating continuous exfiltration over at least a year. The data includes commercial driver licenses and possible Common Access Cards, pointing to systematic harvesting from identity verification processes used by Fortune 500 clients.

This incident fits a recurring pattern of breaches at third-party ID verification providers that aggregate sensitive scans for compliance and KYC workflows. Similar incidents have exposed hundreds of millions of records previously, yet companies continue to centralize high-resolution images without adequate segmentation or encryption at rest. The presence of multi-spectral images suggests the source maintains specialized scanning hardware rather than simple document uploads.

FBI's New Orleans field office inquiry focuses on the Louisiana firm, but independent attribution remains limited to forum claims and sample verification. Technical evidence shows active, incremental data flows rather than a single dump, complicating containment. No public breach notification from the suspected company has appeared in regulatory filings.

The scale enables widespread identity fraud and synthetic account creation. Expect increased use of these records in account takeover campaigns within 90 days unless the exfiltration pipeline is severed.