153 million driver's licenses are for sale on dark web: Check details here
FBI opens a probe after dark web service tied to ID-verification firm IDScan.net exposes millions of licenses
A dark web identity theft service called Nexus began selling digital scans of more than 153 million driver's licences from people in the US and Canada this week, and one of them belonged to Defence Secretary Pete Hegseth.
Cybersecurity journalist Brian Krebs first spotted the listing after a source tipped him off that his own Virginia licence was being used as a free sample to lure buyers.
Krebs and nine volunteers who searched Nexus for their own records all confirmed matches tied to trips they'd actually taken. His mother's licence scan appeared seconds after his own, both timestamped to the same Hertz counter.
Security expert Zach Edwards realised that he had been caught during his visit to Las Vegas and narrowed down his location of being caught to a Planet13 dispensary where electronic ID scanning took place.
This is an example of how IDScan.net, a Louisiana-based company that claims it conducts over 21 million ID scans every month for its clients like Hertz, Target, FedEx, and Caesars Entertainment, could have tracked him down.
IDScan.net told Krebs it was investigating but hasn't confirmed a breach. Caesars Entertainment pushed back hard, telling Krebs it hasn't used IDScan's product since February 2025 and never authorised the company to keep its data.
Target separately told Engadget it wasn't involved, saying it doesn't transmit guest data to IDScan.net at all, a sign the vendor's public client list may not reflect who's actually still exposed.
Over 10 million ID cards, three million travel documents, and 580,000 medical cards, some of which were associated with the membership in a marijuana dispensary, were listed in Nexus.
Larry Baldwin, a research professor, noted that such exposure was particularly problematic for those individuals who cannot alter their identity easily, for example, victims of domestic violence or witnesses participating in witness protection programmes.
Additionally, Edwards maintained that this breach proves that the argument behind the laws requiring age verification by scanning the IDs is not valid.
