Massive driver's license leak traced to ID authentication service, FBI probes
A cybercriminal forum advertised a database containing over 153 million U.S. and Canadian driver's licenses and other ID documents, including that of Defense Secretary Pete Hegseth. The leak is believed to stem from an ID-authentication service in Louisiana that serves major clients. The FBI has begun investigating the breach.
The stolen dataset, advertised under the name Nexus on the Exploit forum, contained far more than driver's licenses: roughly 10 million ID cards, 1.9 million travel documents, 579,000 medical cards, and 429,000 common access cards used by military personnel. Researcher Zach Edwards confirmed his own data appeared in the cache, with timestamps matching his ID scan at a Planet13 dispensary, while journalist Brian Krebs verified entries for friends and family who had rented from Hertz. Both businesses outsourced identity verification to IDScan, a Louisiana-based authentication firm now under scrutiny. The FBI's New Orleans field office has opened an official investigation, and IDScan says it is cooperating. The breach echoes a recent Discord incident where a third-party vendor exposed 70,000 government IDs.
This breach could have outsized consequences because it targets identity documents used for everyday verification, not just financial accounts. Millions of people may face heightened risk of identity theft, fraudulent document creation, and social engineering attacks. The inclusion of a defense secretary's records suggests even high-level officials are not insulated from supply-chain vulnerabilities. It may also intensify debates over online age verification, as privacy advocates warn that centralized ID collection creates attractive targets for criminals.