IC Technology & Cyber — 2026-09-02

FBI Probes Breach of Identity Verification Firm Exposing 153 Million Drivers Licenses Including Senior Government Officials

BLUFBreach confirmation, likely within 60 days, would expose a systemic supply-chain vulnerability in third-party identity verification spanning retail, hospitality, and government credentialing nationwide.

A dark-web service called Nexus advertised digital scans of more than 153 million US and Canadian driver's licenses, plus over 10 million ID cards, at least 3 million travel documents and international IDs, and at least 579,000 medical cards, according to KrebsOnSecurity, which traced the exposure to Louisiana-based identity-verification firm IDScan.net 1. The listings included the driver's license of Defense Secretary Pete Hegseth and other senior government officials, and Krebs reported the FBI's New Orleans field office opened an official investigation into the suspected IDScan.net breach on Monday 1. The cache includes high-resolution scans with infrared and ultraviolet imaging and timestamps matching victims' car rentals, dispensary visits and security checkpoints; the listed record count grew by nearly 400,000 in 24 hours, indicating stolen data is still being uploaded 1. IDScan.net told Krebs it was investigating but had not issued a substantive response as of publication, while the Nexus site went offline hours after the story ran. The firm says its systems perform more than 21 million identity verifications monthly across more than 20,000 locations for clients including Hertz, Target, FedEx and Caesars Entertainment 1.

Analysis
IDScan.net or the FBI will likely confirm within 60 days that the Nexus breach traces to IDScan.net's systems, given the New Orleans field office's active investigation and the company's internal review; confirmation would mark the first verified large-scale compromise of a third-party identity-verification vendor embedded across retail, hospitality, and government transactions and would compel clients such as Hertz and Caesars Entertainment to suspend or re-audit their contracts. Exposure of a cabinet secretary's and other officials' credentials turns a consumer-privacy matter into a personnel-security concern requiring reissuance or enhanced monitoring. The dataset's inclusion of government access-card scans alongside licenses suggests the breach may instead originate further upstream, at an aggregator or contractor handling multiple document types rather than IDScan.net's consumer-facing systems alone. Moderate confidence rests on timestamp corroboration against named individuals' own travel records, tempered by reliance on a single outlet's forensic reconstruction.

2 sources

FBI Probes Service Selling 153M+ Drivers Licenses - Krebs on Security
How ID Verification Became Identity Harvesting - Hollywood LA News