The age check at the rental desk was a copy. On September 1, Brian Krebs wrote that a dark web service called Nexus was selling digital scans of more than 153 million driver’s licenses from the United States and Canada. He traced the pictures to IDScan.net, a New Orleans identity-verification company that sits at rental counters, dispensaries, and retail checkouts. The FBI’s New Orleans field office opened an inquiry the same day. Accounts on X spent the week repeating the number. The copies were supposed to exist. The site went dark a few hours after Krebs published, which does not put the files back.
What got stored
IDScan tells customers it will save an image of every ID it scans. American Banker put that in print on September 4. The company says it runs more than 21 million verifications a month at more than 20,000 locations. Nexus claimed more than 10 million state ID cards, more than three million travel documents, and at least 579,000 medical cards on top of the licenses. Krebs ran a blank search and got about 11.5 million pages. Canadian licenses alone were about 1.1 million, with Ontario the densest pile.
The files were not just the front and back of a plastic card. Krebs found infrared and ultraviolet captures on the same records. Those are the images a bank uses to tell a real hologram from a printout. Once those files leave the scanner, the security feature is a JPEG.
Timestamps matched the moment people handed the card over. Krebs found his own license and his mother’s, seconds apart, from a Hertz rental. Larry Baldwin at Cybera found his tied to a Hertz trip. Zach Edwards found his tied to a Planet13 dispensary in Las Vegas, not the airport and not the hotel. You do not have to be a journalist in a hostile country to show up in this pile. You have to rent a car.
The safety pitch
The demand for this vendor is age checks and KYC. A cashier needs to know you are old enough to buy, or that the name on the card matches the name on the reservation. That is a yes or no question. The industry answered it by photographing the entire document, in three wavelengths, and keeping the photograph.
This week the same timeline filled with a different pitch. World, the identity project formerly called Worldcoin, open-sourced ProveKit on September 2. A post from @0xrichboy on the 7th summarized the claim: prove age, nationality, or that you hold a valid ID, without handing over the document. Zero-knowledge proofs can do that. I wrote about the idea in July. The physical scan already happened, at 20,000 counters, for a year or more according to the people selling the dump, while the cryptographic version was still a press release.
Age-verification laws treat a copy of your face on a government card as the cost of using the internet, or of buying a beer. The copy has a vendor. The vendor has a disk. The disk has a price. Krebs reported Nexus offering records for about $100. Class actions landed in the Eastern District of Louisiana within two days. IDScan has not confirmed a breach in so many words. It added a form for people who think they might have been in one.
I do not need a lab leak to make this point. I need a Hertz counter.
You already paid
Most privacy advice for this is theater. You cannot unscan a license. You cannot rotate a face. Credit monitoring is a consolation prize for a photograph that now trains someone else’s matcher.
The useful question is smaller. Did this transaction need a retained image, or a glance? If a clerk only needed to see that you look like the card, the image should have died at the register. If a bank needed the UV layer, that file should have lived in a vault with a deletion date, not in a product that markets itself on saving every scan. Retention is the product. The breach is the receipt.
I still carry a license because the state requires it to drive. I do not owe a copy to the company that rented me a car for a weekend. Those are different acts. We collapsed them because scanning is cheap and storage is cheaper.
A yes or no check that produces an archive is not a check. It is a collection program with a safety label. The next age gate will promise a zero-knowledge proof. Ask where the original scan still sits.