The Evidentiary Record

• A cybercrime service claimed access to more than 153 million U.S. and Canadian driver’s licenses.
• Records reportedly included Defense Secretary Pete Hegseth’s identification and government access credentials.
• Investigators are examining whether the documents originated from a Louisiana identity-verification provider.

By Samuel López | USA Herald

The FBI is investigating what could become one of the most consequential identity-document breaches ever uncovered in North America—a sprawling database reportedly containing more than 153 million driver’s licenses from the United States and Canada.

The stolen records were allegedly offered through a dark-web service known as Nexus, which was promoted on Exploit, a Russian-language cybercrime forum. The platform claimed it could provide purchasers with high-resolution images and sensitive personal information suitable for identity theft, financial fraud and other criminal activity.

The exposed documents reportedly included the driver’s license of U.S. Defense Secretary Pete Hegseth, immediately elevating the incident from a massive consumer-privacy crisis to a potential national security concern.

Cybersecurity journalist Brian Krebs first reported that the FBI’s New Orleans field office had opened an official inquiry into the source of the images.

Nexus Claimed Access to a Vast ID Archive

In addition to 153 million driver’s licenses, Nexus claimed to possess more than 10 million identification cards, millions of travel and international driving documents, approximately 579,000 medical cards and hundreds of thousands of Common Access Cards.

Common Access Cards are identification credentials issued to military personnel, civilian Defense Department employees and eligible contractors. Their reported appearance in the database raises serious questions about whether the stolen information could be exploited for impersonation, social engineering or attempts to penetrate government facilities and computer systems.

Nexus allegedly allowed prospective buyers to preview partially redacted records before completing a purchase. Krebs became aware of the operation after its promoter used an image of his own Virginia driver’s license as a free sample.

After accessing the service, Krebs reportedly located records belonging to friends and relatives who had given him permission to search for their information. Several had used Hertz rental-car locations, where their identification documents had been scanned.

Security and privacy researcher Zach Edwards also reportedly discovered his information in the database. Edwards had presented his identification at a Planet 13 marijuana dispensary, and timestamps associated with the record allegedly corresponded with that transaction.

Evidence Points Toward an ID Verification Contractor

Hertz and Planet 13 reportedly relied on IDScan.net, a Louisiana-based identity-verification company, to authenticate customer identification.

That connection does not yet establish that IDScan.net was legally responsible for the apparent exposure. However, the overlapping vendors, matching timestamps and document-scanning histories create a significant evidentiary trail for federal investigators.

Nexus operators allegedly claimed they had been continuously extracting information from a major identity-verification company for more than a year. If proven, that allegation could indicate an ongoing compromise rather than a single historical data theft.

IDScan.net told Krebs that it was investigating the matter but was not prepared to release additional information. The company has not publicly confirmed the scope of any breach or established that all records advertised by Nexus came from its systems.

Those distinctions are legally important. The volume of documents remains a claim attributed to the cybercriminal service, while the source and method of acquisition remain under investigation.

Identity Theft and Physical Security Risks

A driver’s license contains far more than a photograph. It may expose a person’s full legal name, address, birth date, signature, license number and physical characteristics. Nexus reportedly offered some ultraviolet and infrared scans—security features ordinarily used to determine whether an ID is authentic.

Criminals armed with those images could potentially create convincing counterfeit documents, open fraudulent accounts, defeat identity-verification procedures or craft highly personalized phishing attacks.

The consequences could be especially dangerous for domestic-violence survivors, protected witnesses, military personnel and public officials whose residential information may require heightened protection.

The incident also exposes a growing weakness in mandatory identity-verification systems. Businesses increasingly scan identification to verify age, prevent fraud or comply with government requirements, but consumers often have little control over how long those images are retained or how many contractors receive them.

Federal investigators must now determine who accessed the records, whether the compromise remains active and which companies or individuals must be notified. Potential civil and regulatory exposure could ultimately depend on contractual security obligations, applicable breach-notification laws, data-retention practices and whether reasonable safeguards were maintained.

For millions of people, however, the core danger is already clear. A document handed over for a routine rental or retail transaction may have been transformed into a permanent tool for identity theft.

Stay Ahead of the Story

For exclusive investigative reporting, breaking legal and national security analysis, and insider-level coverage you won’t find anywhere else—subscribe to the USA Herald newsletter.

👉 Follow us on X: https://x.com/RealUSAHerald