A Russian cybercrime forum reportedly hosted a trove of 153 million US driver's licenses, all traced back to a single breached identity verification vendor.
Security researcher Brian Krebs traced the leak to Louisiana-based IDScan, which handles ID verification for companies including Hertz and FedEx. The data reportedly surfaced through a dark web listing service called Nexus on a forum known as Exploit, and among the exposed records was said to be one belonging to US Defense Secretary Pete Hegseth. Krebs also found his own license in the trove, along with his mother's - both tied to a Hertz rental, which let him confirm IDScan as the source. Beyond US licenses, the haul reportedly included 1.1 million Canadian licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical cards, with Krebs noting the count grew by nearly 400,000 records in the days before Nexus's listing disappeared. The FBI has since opened an investigation.
Driver's licenses are the default proof-of-identity for renting a car, clearing a background check, or buying anything age-restricted, so a leak this size hands fraudsters a head start on real people's lives, not just their email addresses. The apparent inclusion of a sitting cabinet secretary is a reminder that identity-verification vendors, which most consumers never choose and can't opt out of, are now a single point of failure for millions of people at once.
IDScan hasn't explained how the breach happened, and with Nexus scrubbed from the dark web, nobody knows yet how many buyers already grabbed a copy before it vanished.