FBI Probes Massive Data Breach as 153 Million Driver’s Licenses Surface on Dark Web

NATIONAL — In what cybersecurity experts are calling one of the largest identity document breaches in history, more than 153 million driver’s licenses from the United States and Canada have been offered for sale on the dark web. The FBI has opened an investigation, and the breach appears to stem from a Louisiana-based identity verification company used by major retailers, rental car agencies, and other businesses.

The dark-web service, called Nexus, surfaced in late August on the Russian cybercrime forum Exploit, advertising a searchable database of identity documents. Alongside the driver’s licenses, the service listed more than 10 million identification cards, 3 million travel documents, and at least 579,000 medical cards. The operators claimed to have been exfiltrating data for over a year.

How the Breach Was Discovered

Independent cybersecurity journalist Brian Krebs first reported the breach after the cybercriminals behind Nexus offered his own Virginia driver’s license as a free sample to advertise the service. The record included front and back scans of the license, along with infrared (IR) and ultraviolet (UV) images—captures typically made by specialized document scanners rather than cameras.

Krebs and security researcher Zach Edwards traced the source by cross-referencing timestamps on the scanned images with their own travel records. The common link was in-person ID scans at Hertz rental counters and a Las Vegas marijuana dispensary, Planet13—both of which use identity verification technology from IDScan.net. Full coverage of the investigation can be found at https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/.

Suspected Source: IDScan.net

IDScan.net, based in New Orleans, processes more than 21 million identity verifications monthly at over 20,000 locations worldwide. Its clients include Hertz, Target, FedEx, GameStop, and Caesars Entertainment, as detailed at https://idscan.net/.

The company has acknowledged it is investigating a “potential security incident” but has not confirmed unauthorized access or the full scope of any breach. TechCrunch reported on the company’s response at https://techcrunch.com/2026/09/02/it-sure-looks-like-hackers-breached-a-major-id-card-verification-service/. The FBI’s New Orleans field office has opened an official investigation, according to PCMag at https://www.pcmag.com/news/hacker-allegedly-stole-153-million-drivers-licenses-is-now-selling-them.

High-Profile Victims and Public Safety Concerns

The leaked database reportedly includes the driver’s license of U.S. Secretary of Defense Pete Hegseth and identification belonging to an FBI assistant director. The Department of Defense has stated it is “aware of these reports and is evaluating them,” as noted by CyberInsider at https://cyberinsider.com/153-million-drivers-licenses-exposed-in-suspected-idscan-breach/.

Security experts warn that this breach poses unique dangers. Unlike a compromised password, identity document details—including photos, addresses, dates of birth, and IR/UV security markers—cannot be easily changed. The data could be used for identity theft, fraudulent credit applications, and account takeovers.

Larry Baldwin, a principal intelligence researcher at Cybera, noted that for individuals in witness protection or fleeing domestic violence, the exposure of identity documents could pose a direct threat to personal safety. Reclaim The Net covered this angle at https://reclaimthenet.org/idscan-net-breach-exposes-millions-id-documents.

The Nexus Service Goes Dark

Shortly after Krebs published his investigation on September 1, the Nexus website went offline, replaced by a message reading: “This service is no longer available.” It remains unclear whether the operators shut it down voluntarily or moved to a new domain. Engadget reported on the site’s takedown at https://www.engadget.com/2249522/digital-scans-of-153-million-drivers-licenses-leaked-to-the-dark-web/.

What This Means for Consumers

For millions of North Americans, the exposure of identity documents could have long-lasting consequences. Cybersecurity experts recommend that concerned individuals:

• Monitor financial accounts for unauthorized activity
• Place a credit freeze with major credit bureaus (Equifax, Experian, TransUnion) to prevent new accounts from being opened in their name
• Be cautious of phishing attempts and suspicious account recovery messages

The Federal Trade Commission advises consumers to consider free credit freezes as a proactive measure against identity fraud. More information is available at https://www.ftc.gov/.

Ongoing Investigation

As of early September 2026, IDScan.net has not confirmed the breach or its scope. The FBI investigation is ongoing. This developing story underscores the risks of entrusting sensitive identity data to third-party verification vendors, a growing concern as governments expand age-verification and identity-check requirements.

---

This article is based on reporting by Krebs on Security, TechCrunch, PCMag, CyberInsider, Engadget, and Reclaim The Net. For updates, follow SilverValleyMorning.com.