Nexus Driver's-License Trove: Exported National-ID Spreadsheet Flagged by Proactive DLP

KrebsOnSecurity reported on September 7 that a dark-web service calling itself Nexus is advertising one of the largest troves of North American identity documents ever seen: more than 170 million records including over 153 million U.S. and Canadian driver's licenses, roughly 10 million ID-card images, 3+ million travel and other international documents, and about 579,000 medical documents. Free samples included editor Brian Krebs's own Virginia license - front, back, infrared, and ultraviolet captures with date-time stamps, which researchers say points to document-scanning hardware at an identity-verification provider. After an FBI assistant director and researchers from two security firms were identified among the victims, the FBI's New Orleans field office opened an investigation; the trail leads to IDScan.net, whose merchant customers include Hertz, Target, FedEx, Motorola Solutions, Jack Henry, and Caesars Entertainment, though IDScan.net has not commented and the site was adding roughly 400,000 new license images every 24 hours. Whatever the final attribution, the exposure class is clear: identity PII that leaves an organization inside routine office files - an export, an attachment, a shared folder. This demo reproduces that boundary safely with synthetic data: malicious-export.xlsx is an everyday spreadsheet whose rows carry names, national-ID numbers, and phone numbers (Test User A-C, e.g. A123456789), the same government-issued-ID record class at the center of the Nexus trove; clean-export.xlsx is the same file after processing, sensitive fields redacted. MetaDefender Proactive DLP content-inspects the file for national-ID and PII patterns and blocks or redacts it before the data can be emailed, uploaded, or copied out (MITRE ATT&CK T1005 - data from local systems).