How a 160-Million-Record ID Database Spread Across the Dark Web
October 15, 2026
In late August 2026, a post appeared on the Russian-language cybercrime forum Exploit offering persistent access to a proprietary database of breached identity documents, reportedly pulled from an identity verification vendor and its client base. Within days, the same dataset was being repackaged and resold across at least three additional forums, a dedicated storefront, and a cluster of Telegram channels — long after the original listing had gone quiet.
DarkOwl analysts tracked the spread of this dataset, known by the name of the tool its original seller built to access it: Nexus. This post walks through what we found, and what it says about how stolen identity data circulates once it hits the dark web. In the interest of protecting the people whose personal documents were exposed, this post omits names, images, and identifying details of any individuals referenced in the underlying leak.
How It Started
On August 30, 2026, a relatively new Exploit forum account calling itself “databroker1,” registered just a few months earlier, posted an offer for “our proprietary and exclusive database of breached identity documents.” The post claimed persistent, continuous access to a major identity verification company and its customers, “which include multiple Fortune-500 companies,” with new data being exfiltrated for “over a year.”
The advertised haul: more than 160 million North American driver’s licenses and identification cards, plus over 10 million additional documents spanning international IDs, travel documents, residency cards, and medical cards. Records reportedly included barcode data and, in some cases, front-and-back scans of the physical document under regular, UV, and IR light.
To manage sales, databroker1 said they had built Nexus, a web application for browsing and purchasing individual records. Registration and searching were advertised as free, with pricing per record, and access was offered via a dedicated onion address.
To prove that the data was genuine, the seller pointed to a sample record. The document shown was independently confirmed as authentic by the person it belonged to, Brian Krebs, a security researcher who wrote publicly about receiving a tip that their own identity document was being used as a sales sample.
A Quick Disappearance
The Nexus storefront didn’t last long. Three days after the original post, another forum user reported that “this service is no longer available.” Other members speculated the operator had gotten spooked and pulled the listing down; at least one prospective buyer claimed to have seen the data firsthand and offered to pay several thousand dollars for access regardless. By the time DarkOwl reviewed the listing on September 14, the Nexus onion address was returning an invalid-site error, and the original post was subsequently removed from Exploit entirely. The “databroker1” profile, which had made only a single post, was gone as well.
Where the Data Likely Came From
The leak was first reported publicly by Brian Krebs, who said a source had alerted them that their own ID was being used as proof of the data’s authenticity. Their investigation pointed to IDScan, an identity-verification technology provider, as the likely source.
On September 4, 2026, IDScan disclosed that it had identified possible unauthorized access to data stored in its cloud environment, with potentially affected information including full names, driver’s license numbers, and numbers from other government-issued IDs. The company said it was cooperating with federal law enforcement.
DarkOwl analysts have not independently confirmed that the data offered on Exploit came directly from IDScan. However, several of the actors who later resold the dataset explicitly named IDScan as the source in their own posts.
The Data Goes Wide
Once the original Nexus listing disappeared, the same dataset resurfaced across other corners of the dark web, each time with a new seller and a different price tag.
An account using the alias ShinyHunters advertised the dataset, describing document types and a list of affected organizations, and confirming IDScan as the source. The listing referenced an original asking price of $500,000, later dropped to $300,000, and claimed the group had “had this data for years” — expressing surprise that Nexus was independently reselling it.
September 5–6, 2026 — DarkForums
Near-identical posts appeared from separate DarkForums accounts, each reusing much of the same wording as the BreachForums listing but offering different contact channels and sample links — one pointing to a storefront selling the same dataset outright for $6,000, another asking as much as $90,000.
September 6–14, 2026 — Telegram
Multiple Telegram channels shared the same pricing, victim list, and sample material, occasionally forwarding posts between channels to widen their reach. One channel was later banned for violating Telegram’s terms of service; another continued circulating contact details, specifying it would only accept cryptocurrency payment.
Who Says They Were Affected
Threat actors reselling the dataset listed a range of organizations they claimed were impacted as customers of the identity-verification vendor, spanning retail, hospitality, automotive, finance, and gaming sectors, among others. DarkOwl has not independently verified this list it reflects claims made by the threat actors themselves, inclusion on a criminal seller’s list is not proof that an organization’s data was actually compromised.
Why This Matters
The Nexus case is a useful illustration of a pattern DarkOwl sees repeatedly: identity-verification and KYC vendors are high-value targets precisely because they concentrate the two things identity thieves want most — document scans and the personal data needed to use them. And once a dataset like this reaches even one dark web forum, taking down the original listing does little to stop its spread. Within two weeks, the same records had been repackaged by at least four separate sellers across forums, a dedicated storefront, and Telegram, each pricing and marketing it independently. Although it cannot be confirmed that these actors actually had access to the data they claimed. Actors have been known to take advantage of high profile data leaks to scam fellow criminals.
Key takeaways: a single compromised vendor can expose data spanning hundreds of downstream customers, not just the vendor itself. Stolen datasets rarely stay with one seller expect rapid resale, rebranding, and price competition once data surfaces. Overlapping infrastructure and copied listing text can reveal ties between seemingly unrelated dark web personas. And continuous monitoring matters: the original listing was gone within days, but the data kept circulating for weeks afterward.
DarkOwl continues to monitor forums, marketplaces, and messaging platforms associated with this activity for further developments, including any indication the dataset is being distributed for free or used in follow-on fraud campaigns.
Curious to learn more about darknet monitoring? Contact us.
