More than 153 million U.S. and Canadian driver’s licenses, along with other identity documents, were reportedly offered for sale on the dark web for a limited time.
Cybersecurity journalist Brian Krebs reported that the service, called Nexus, claimed to have 153 million driver’s licenses, 10 million ID cards, 1.9 million travel documents, 1.3 million international driver’s licenses, 579,000 medical cards, 429,000 common access cards, 91,000 residence cards, 77,000 employment authorization records and 5 million other documents. The data was allegedly sourced from an ID authentication service based in Louisiana.
On Monday, a source alerted KrebsOnSecurity to a service advertised by a new user on the Russian cybercrime forum Exploit. The service offered access to digital scans of identity documents belonging to more than 170 million people in North America.
Krebs found his own driver’s license on the website, prompting him to investigate further. Information belonging to Secretary of Defense Pete Hegseth was also reportedly found in the database, raising additional concerns.
READ: FBI, Australian police arrest two cybercrime suspects (August 31, 2026)
Krebs searched the database for information belonging to several friends and family members with their consent and found that their documents were also listed. All of those individuals had used Hertz to rent a vehicle.
Krebs also spoke with security and privacy researcher Zach Edwards, who said his information was also found on Nexus. Edwards said he had not recently rented a car but had used his identification at a Planet 13 marijuana dispensary.
The timestamps on scanned images of driver’s licenses and other identity documents appeared to coincide with the times the individuals had used their IDs at the companies, suggesting they could have been sources of the leaked data.
However, Planet 13 and Hertz do not conduct their own identity authentication. Instead, they contract with third-party providers. Both companies have used IDScan for identity verification and authentication services.
READ: DOJ seizes $560,000 in cryptocurrency tied to alleged Hamas fundraising scheme (September 1, 2026)
According to evidence gathered by Krebs, the leaked data appears to be centered on IDScan. Krebs said he contacted the company about the alleged leak, and the company is investigating the matter.
The FBI is also investigating. Its New Orleans field office has opened an investigation into the alleged breach.
Edwards said that as more in-person and online services require people to share their driver’s licenses, vendors that collect such sensitive information should be held to higher standards.
“This episode should further strengthen the resolve for people who are fighting back against online ID schemes which are requiring countless providers to ask for drivers licenses in order to access services under the guise of protecting kids,” Edwards told KrebsOnSecurity. “These systems are putting sensitive data into more and more 3rd party vendors, and we don’t have nearly the oversight to ensure they are safe.”