The source could be an ID verification service in Louisiana, though the FBI has opened an investigation.
More than 153 million scans of US and Canadian driver’s licenses went on sale recently on the dark web, according to cybersecurity journalist Brian Krebs. A service called Nexus went live to sell these documents and many others, which included medical cards, employment records and residence cards.
Krebs confirmed the authenticity of these documents by interacting with the cybercriminals, who provided him with a scan of his own license. Other victims have confirmed their scans were correct. Incidentally, the hackers also showed Krebs a scan of Secretary of Defense Pete Hegseth’s driver’s license, which seems like another concerning breach for someone so high up the governmental totem pole.
even the cybersecurity journalist reporting this found his own drivers license listed for sale. brian krebs learned about the database because someone tipped him off that his id was being used as the free sample to advertise it. https://t.co/CPq4ykFKRO pic.twitter.com/amSVLQiVVQ
— Michael Rusch (@weeddude) September 2, 2026
The FBI has launched an investigation, but Krebs has identified a hack of a Louisiana-based identification verification company called IDScan as the likely source of the breach. Many of the victims have one thing in common. They rented a car from Hertz, which uses IDScan for verification purposes.
The company’s client list also includes Target, FedEx, Motorola and Jack Henry. The FBI seems to confirm Krebs’ claims, as the New Orleans field office launched the investigation.
The Nexus “service” was originally advertised on a Russian cybercrime forum called Exploit which used Krebs’ license as a free sample to lure in customers. Nexus has since shuttered and the login page announces that the platform is no longer available.
It’s good news that these documents aren’t currently for sale on the dark web, but they’re still floating around out there. A similar data breach impacted Discord after its third-party service provider was hacked. This led to the exposure of more than 70,000 government IDs.
