More than 153 million driver's licenses, along with millions of other ID documents, briefly went up for sale on a Russian cybercrime forum this week - and the FBI has opened an investigation.
Security journalist Brian Krebs first noticed the listing, called Nexus, after whoever was selling it posted his own driver's license as a free sample. Krebs also spotted a preview of U.S. Secretary of Defense Pete Hegseth's data in the trove, along with entries for friends and family who confirmed the records were real. Every person he checked had one thing in common: they'd recently used a driver's license to rent from Hertz or verify their age at a Planet13 dispensary, both of which outsource ID checks to a company called IDScan. Krebs has flagged IDScan as the likely source based on matching timestamps, though the company - which says it's investigating - has not confirmed it, and the FBI's New Orleans field office is now looking into the breach too.
This is what happens when identity verification gets outsourced to vendors nobody's heard of. Driver's licenses aren't just photo ID - they're often enough to open a bank account or a line of credit, and the leaked scans reportedly include UV and infrared images, not just the front-facing photo. For anyone in witness protection or fleeing an abuser, a public database like this isn't an inconvenience, it's a safety risk.
It's also a preview of what mandatory age-verification laws promise to deliver at scale: more of your ID sitting in more third-party databases. Discord learned that lesson this year when a vendor breach exposed 70,000 government IDs. Nexus, at least for now, is offline. The data it leaked isn't.