It was supposed to be a routine transaction. Renting an SUV for a weekend trip required little more than handing over a driver's license. An employee swiped the card through a scanner. Within hours, a high-resolution image of that license — both front and back — was offered for sale on the dark web.

The discovery came through a Tuesday investigation published by security journalist Brian Krebs on his site KrebsOnSecurity. The report outlined a new ID theft service called Nexus, which claimed to host more than 153 million driver's license images. The author of this article was among those affected. So, too, were Krebs himself, his mother, an FBI assistant director, and several security researchers.

What makes Nexus particularly troubling is not just the sheer volume of identity documents, but the depth of detail in each listing. The stolen files are not simple photographs. They include scans taken under infrared and ultraviolet light, formats that could allow fraudsters to produce counterfeit IDs that pass the kind of hologram tests used at airports, casinos, and police checkpoints.

An Underground Bazaar for Every Type of ID

According to the KrebsOnSecurity report, Nexus markets itself as a wholesale supplier for identity thieves. Customers could search for licenses by state, age, ZIP code, and even facial hair. Prices were remarkably low — a few dollars per record — with discounts for bulk purchases. Beyond driver's licenses, the service advertised passports, Social Security cards, birth certificates, and permanent resident cards from multiple countries.

Researchers who analyzed the market described it as a one-stop shop for what is commonly known as 'fullz' — criminal shorthand for full identity packages. At least one of the service's listings included not only the author's license but also a second file labeled 'IR 950 nm' and another 'UV 365 nm,' indicating that the original scanning device had captured more than just the visible surface.

• More than 153 million driver's license images available for sale
• Scans include standard, infrared, and ultraviolet formats
• IDs from all 50 states, plus other nations, passports, and security documents
• High-profile victims include journalists and law enforcement executives

How a Physical Card Becomes a Digital Commodity

The author's experience — renting a car from a well-known national chain and having a license appear on the dark web hours later — points to a troubling supply chain. Rental counters routinely scan customer licenses as part of the check-in process. The images are often stored by the rental company or transmitted to a third-party verification vendor. The data is meant to be used in the event of damage, fraud, or law enforcement requests. But the investigations suggests that those repositories have become a lucrative target for hackers.

The exact source of the Nexus data remains unclear. Krebs was unable to trace the origin definitively, but security analysts suspect that a vendor providing advanced ID scanning hardware to rental agencies may have been compromised. The fact that infrared and ultraviolet images are included suggests that the device used was capable of forensic-grade capture, not a simple office scanner.

This is a systemic problem, noted a cybersecurity researcher with knowledge of the case. We hand over the most sensitive documents of our lives to a faceless agent at a counter, and then trust that every vendor and subcontractor in that chain will protect the data forever. They don't. They are only as secure as the worst link in a very fragile chain. Usually, these records are stored for years, long after the rental is over.

Real World Consequences

Critics argue that the car rental industry is not doing enough to minimize the data it collects. Unlike a hotel or restaurant, renting a vehicle does not legally require a comprehensive digital scan and storage for identification in most jurisdictions. The standard should be to verify the license visually and return it to the owner, not to turn it into a permanent digital asset.

The consequences for victims can be severe. Armed with an infrared copy of a license, criminals can pass security checks at borders, open bank accounts, apply for loans, receive unemployment benefits, and even commit crimes under another person's name. The high-profile victims — including an FBI executive — illustrate that no one is immune.

A Pattern of Data Hoarding

The Nexis episode fits into a broader pattern of corporate data retention policies that create treasure troves for criminals. In 2017, Equifax, a credit reporting agency, exposed more than 140 million driving licenses and other personal data. In 2020, a breach at a third-party system used by Marriott exposed the passport numbers of millions of guests. Each incident begins with an everyday transaction — a car rental, a job application, a credit check.

Legislators have been slow to respond. Several states have proposed laws that would limit the retention of biometric and government ID data, but none have passed a sweeping federal statute. The FTC has urged companies to delete unnecessary data, but enforcement is uneven and penalties often feel like a cost of doing business.

Protecting Yourself in a World of Sellers

While consumers cannot control what a retailer or rental agency does with a license, security experts say there are steps to reduce exposure. They recommend using a credit freeze, monitoring financial accounts, and avoiding letting employees 'run' the license through an imager if a quick visual check would suffice. However, this might not always be practical. A growing number of transportation security and background check systems rely on one-time ID verification, creating an entire ecosystem around these scans.

The author has since received a replacement license and reported the possible fraud to authorities. Yet the original scan remains on the dark web, awaiting a buyer. The service is still in operation. Anyone with a few dollars could obtain that image, the infrared layer included, and commit a near-seamless act of impersonation.

The rental car industry has a history of resisting change. But this latest disclosure forces a new question: if your license is scanned at a rental counter today, who will be holding a copy of it tomorrow? The answer, for now, is all too often — everyone.