153 million identity documents for sale, and not one stolen from a careless user

On 31 August, a new vendor appears on Exploit, a Russian-speaking criminal forum. To prove the quality of his catalogue, he publishes a free sample: the driver's licence of Brian Krebs, the investigative cybersecurity journalist who would be looking into him within forty-eight hours. Commercially, you cannot fault his sense of demonstration.

The service was called Nexus. You typed a name, you got a document. The US Secretary of Defense's licence was listed there at a hundred dollars.

Yahoo did better on volume, with three billion accounts in 2013. A password changes in thirty seconds, a bank card is blocked with one phone call, and the number on a state-issued document stays with you for ten years, your face somewhat longer.

What the Nexus database actually held

More than 153 million American and Canadian driver's licences, including around 1.1 million Canadian ones, on top of more than 10 million identity cards, more than 3 million travel and international documents, and at least 579,000 medical cards, cannabis dispensary cards included. In total the vendor claimed the papers of more than 170 million people in North America, and said he had been exfiltrating continuously for over a year.

That figure comes from a sales pitch on a criminal forum, with all the credit such a source deserves. Krebs tested it his own way: an empty search returned about 11.5 million pages of results at fifteen entries per page, and the stock grew by nearly 400,000 records during the twenty-four hours he was watching.

His verification method, on the other hand, holds up. He asked a dozen people close to him for permission to look up their papers. Nine were in there, and every one confirmed having been where the file names said, on the date they said. His own timestamp matched a June 2025 flight for a family funeral. Zach Edwards's matched a stay in Las Vegas during DEFCON.

Each image therefore carries the time and place of a check. Incidentally, the database also tells you where those people were that day, which did not feature in the sales pitch.

Why a licence image is worth more than a stolen password

Some records contain six images of the same document: front and back in visible light, front and back in infrared, front and back in ultraviolet. A professional verification reader lights documents in those three spectra to check the security features the eye cannot see, and IDScan.net publicly documents this six-image process.

An attacker holding the infrared and ultraviolet rendering of a genuine licence holds the answer the machines built to spot forgeries are expecting. The system that certifies a document as real has published its own answer key.

The consequence reaches well beyond the 153 million people exposed to identity theft. Any verification system that treats possession of a scan as proof of identity has just handed out its key in 153 million copies, and will nonetheless carry on working on Monday morning as if nothing had happened.

My passport, an Interpol officer and a WhatsApp group

I read this story thinking back to a Turkish airport.

The man approaches me at bag drop. Not at passport control, not at customs: in front of the belt, between the scales and the queue. He is from Interpol, he tells me so, and it was true. He takes my passport, photographs it with his phone, explains that the image is going to the passport control desk, and hands the document back.

When I asked, a little further along, the answer was no. Nobody had requested that photo. What followed lasted considerably longer than an ordinary check, in a room where the words police custody had stopped being a figure of speech, and during that time my passport was already circulating in a WhatsApp group.

This was in transit to Russia, where I then spent a month watching my VPNs fall one by one. Two phones prepared, one clean for the border, the other encrypted and switched off, weeks of rehearsed reflexes in the manner of the politely paranoid. The only document that left the country without me is the one I handed over myself, because someone asked nicely.

The incident itself is trivial. The justification deserves a pause, though: a perfectly plausible administrative reason, stated with confidence by someone who had the authority to state it, and matching no existing procedure. There was an act, and a wrapping to make it acceptable.

The same act could have been legitimate, and nothing in the scene allowed you to tell. Every identity check looks alike, whether it rests on a written obligation or on the initiative of an officer with his phone in his hand.

Can a hotel keep a copy of your identity document?

No. The CNIL, the French data protection authority, answers no to that precise question, and has done for a while.

The establishment may ask you to present the document, in particular to establish your nationality, since hotels must have foreign guests fill in an individual police form. It may also ask if you pay by cheque. It has no right to keep the photocopy or the scan.

The rule is public, free, and fits in one paragraph. Now count the scanners you have seen behind a reception desk.

Last summer, close to 100,000 passport and identity card scans collected in Italian hotels turned up for sale on the dark web, and I wrote about it for TourMaG at the time. The intrusions were in no way spectacular: default passwords, workstations left open, unencrypted storage, configurations put off until later because it was peak season. The attackers did not need to be brilliant. The documents were there, in high resolution, filed by guest.

People always ask how they got in. I prefer to ask why there was something there to take.

What is left once the file is closed

Follow the path of an ordinary supporting document. It arrives by email, someone saves it to a shared folder, forwards it to a colleague for approval, maybe prints it. The request is handled, the file closes.

You now have a copy in the sender's mailbox, one in the recipient's, one in the shared folder, one in the backup of the shared folder, one in the phone of the person who approved it, and one on the printer if the day was busy.

A retention period follows from the purpose pursued and the applicable obligations, it gets documented, and it comes to an end. Some retention is perfectly justified and I am not arguing for wholesale deletion. Keeping a piece of information is one regime, leaving it reachable everywhere and by everyone in day-to-day tools is another, and the CNIL explicitly separates current retention from restricted-access archiving.

An organisation can have an excellent reason to hold your identity document, and no reason at all to leave five copies of it lying around.

Why nobody is responsible for reopening the question

« We have always done it this way » explains where a practice comes from. On its present usefulness, the argument stays quiet. The minimisation principle has said the opposite from day one: you collect what is necessary for a defined purpose, and the purpose exists precisely to prevent collecting things just in case.

So there is no legal gap to fill. The rule is written, it is free, and the procedure has simply never crossed paths with it.

Blaming careless staff is convenient and wrong. What I see on assignment looks more like this: the receptionist applies the instruction she was given, the site manager inherited that instruction from his predecessor, the software vendor shipped the scan feature because the market asked for it, and the retention schedule sleeps in a folder nobody has reopened since the initial audit. Everyone does their part correctly. The decision belongs to no one in particular, which amounts to saying it never gets made.

That responsibility does have names, though: the people who decide which documents are required, which tools are bought, which access is granted and what the deletion rules are. They appear on any org chart. They are almost never named.

What should we demand of those holding our copies?

Why the whole document, rather than the piece of information you need? A date of birth is not an identity card, a nationality is not a passport, and being of age can be attested without revealing a complete civil status.

What obliges you to keep it, for how long, and with which processors? The answer does not fit in a line of a privacy policy. It fits in a written retention period and a deletion actually carried out, that someone can show you.

And what does your verification rest on, if holding the image of a document is enough to convince you that the person in front of you is its holder? Nobody asks that one, and the Nexus affair makes it frankly uncomfortable.

A word on messaging, because the remark comes up every single time I tell the passport story. Yes, there is WhatsApp in my account of it. Encrypting the transport remains essential and says nothing about whether the transfer was necessary. Switching apps without revisiting the procedure leaves the original question intact: why did that copy have to be sent at all.

Proof rather than a photocopy

Since 2024, France Identité has generated a single-use proof of identity, a PDF signed electronically by the French interior ministry, designed to prove an identity without handing over the image of the card. The CNIL also supports mechanisms that attest to a single attribute, being of age for instance, without revealing the full identity to the service being used.

It requires the new bank-card-format identity card, an NFC-capable phone, and a recipient willing to accept it, which still leaves plenty of room for discussion at the counter. These architectures remove neither the need to secure the initial enrolment nor the need to audit the verifier, a subject I developed in connection with the law of 21 July.

They prove at least that we know how to manufacture proof without manufacturing a stockpile.

What remains open

The exact origin of the data is not established. IDScan.net says it is investigating, the FBI's New Orleans office is looking into it, and the class actions filed in Louisiana may yet produce what no press release has produced so far: a written retention period, a scope, a date when the exfiltration began.

The rest depends on none of those answers. We spend considerable energy telling people not to hand their papers to just anyone, and far less asking what the legitimate recipients do with them afterwards. « Have you verified their identity » has stopped being a sufficient question. The next one begins with: what did you keep after verifying it, and who can still reach it this morning.

My passport circulated because a man found it normal to make an image of it, and because no line of his job description invited him to ask whether it was. I had two phones and an encrypted tunnel. All it took was a camera and a polite sentence.

In the Italian hotels as on that marketplace shut down last Tuesday, the hardest work had already been done by honest people following procedure.

Further reading

• France's worst data breaches of 2026: the ranking (spoiler: you're in it)
• A week of data breaches in France: the file nobody wanted
• On 1 January 2027, France will verify the identity of all its adults
• A month in Russia: the day fourteen VPNs went down
• CNIL 2025 Report, reading a regulator in transition
• 100,000 passports stolen from hotels, and what if it happened to you tomorrow? (TourMaG, 16 September 2025)
• Concrete steps, by user profile, are gathered on etrecyber.fr.

Sources

• Revelation of the Nexus service, composition of the database, timestamp verification with nine acquaintances and identification of IDScan.net as the probable origin: KrebsOnSecurity, 1 September 2026.
• Investigation by the FBI's New Orleans office, shutdown of the service and unestablished origin of the data: TIME, 3 September 2026 and Reuters dispatch of 2 September 2026.
• Breakdown of the documents, Canadian volume and verification volumes claimed by the provider: SecurityWeek and Infosecurity Magazine, 3 September 2026.
• Secretary of Defense's licence offered at a hundred dollars: Cybernews.
• Class actions filed in Louisiana: BleepingComputer, 5 September 2026.
• Prohibition on a hotel keeping a copy of an identity document, and the individual police form regime: CNIL.
• Breach of around 100,000 scans collected in Italian hotels: TourMaG column, 16 September 2025.
• Single-use proof of identity signed by the French interior ministry: France Identité.