Dark-web service exposed over 153 million driver's license scans; FBI investigates

The service, advertised on the Russian cybercrime forum Exploit, offered more than 153 million driver's licenses, more than 10 million identification cards, more than three million travel documents or international IDs and at least 579,000 medical cards, according to Krebs. A post advertising Nexus said the database was being continuously fed and adding about half a million new records daily from "a major identity verification company." Over a 24-hour period, the number of available driver's license records grew by nearly 400,000, Krebs reported.

Krebs said he confirmed the authenticity of the records after Nexus administrators used a scan of his own Virginia driver's license as a free sample to attract buyers. Other affected people, including his mother, an FBI assistant director and several security researchers, also confirmed their scans were accurate. The database included a scan of Defense Secretary Pete Hegseth's driver's license, according to Krebs. The files contained front-and-back images as well as infrared and ultraviolet captures that may help counterfeit IDs pass hologram tests, Ars Technica noted.

Working with security researcher Zach Edwards, whose own ID was in the leaked data, Krebs identified the likely source as IDScan.net. The Louisiana company's clients include Hertz, Target, FedEx, Motorola and Jack Henry. Its scanners use infrared and ultraviolet light, matching the leaked file formats. Krebs traced the data to IDScan by comparing timestamps on leaked images against the times customers had their IDs scanned at Hertz rental counters and a Planet13 dispensary.

IDScan chief operating officer Jillain Kossman told Krebs that the company is investigating the incident. Chief executive Jimmy Roussel did not return a request for comment from TechCrunch. A DoD spokesperson did not respond about Hegseth's license, and an FBI spokesperson did not answer TechCrunch's inquiry. Shortly after the report was published, Nexus vanished from the dark web, replacing its login page with the message: "This service is no longer available."

The breach ranks among the largest known exposures of identity documents and comes as governments expand age-verification rules that require people to upload government IDs to visit websites or apps. TechCrunch reported that security experts and privacy advocates have long warned that storing large amounts of identity documents increases the risk of mass theft.