FBI Investigates Massive Driver’s License Leak; ID Verification Firm IDScan Emerges as Suspected Source

Data from 153 million US and Canadian licenses reportedly sold on dark web, including SecDef Pete Hegseth’s information

edit

By LineZotpaper

Published3 September 2026

Updated4 September 2026

Read Time2 min

Sources2 outlets

The FBI has opened an official investigation into the reported leak of more than 153 million US and Canadian driver’s licenses and other identity documents offered on a Russian cybercrime forum, with the investigation centering on Louisiana-based identity verification company IDScan.net, according to a report by cybersecurity journalist Brian Krebs.

The investigation, being handled by the FBI’s New Orleans field office, follows a report published this week detailing the dark web service “Nexus,” which advertised roughly 153 million driver’s licenses, 10 million ID cards, 1.9 million travel documents, and other identity records — allegedly obtained from an ID-authentication service provider based in Louisiana.

Krebs, reporting via Tom’s Hardware, said the service was listed on the Russian-language cybercrime forum Exploit and included a free sample of his own driver’s license. A separate preview reportedly contained the driver’s license information of U.S. Secretary of Defense Pete Hegseth.

Investigators linked the leak to IDScan.net after determining that individuals found in the database shared a common thread: many had used Hertz rental cars, while security researcher Zach Edwards confirmed his information appeared after using his ID at a Planet13 marijuana dispensary. The timestamps on scanned identity documents matched the moments those individuals used their IDs at those businesses, and both Hertz and Planet13 contracted IDScan.net for identity verification and authentication.

Krebs contacted IDScan.net, which acknowledged the investigation. “At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation,” said Jillian Kossman, a marketing and operations leader at idscan.net.

The breach has also renewed privacy advocates’ concerns about online age verification requirements. The Electronic Frontier Foundation has urged California’s governor to veto a bill mandating online age checks, arguing such measures lead to the collection of sensitive identity data.

As of this writing, the Nexus service was no longer available, but the full scope of the leak remains under investigation.

Analysis

Why This Matters

153 million driver’s licenses and other identity documents constitute a massive trove of personally identifiable information that could fuel fraud, identity theft, and targeted attacks.
The inclusion of Defense Secretary Pete Hegseth’s data raises national security concerns about the exposure of senior officials’ personal information.
The incident highlights the risks of centralized identity verification systems and the potential consequences of online age verification mandates.

Background

Nexus was advertised on the Russian cybercrime forum Exploit, claiming to hold millions of identity documents. Investigators, including cybersecurity journalist Brian Krebs, found that the data appeared legitimate — verified through consenting friends and family members — and traced a common thread to ID verification services used by Hertz and Planet13. IDScan.net, the shared provider, said it was investigating the matter. The FBI’s New Orleans field office has opened an official investigation into the breach.

Key Perspectives

IDScan.net: The company acknowledged the reports and said it is investigating, though it has not confirmed or denied a breach. It thanked the journalist for information that may help its team. Privacy advocates / EFF: They point to this type of incident as evidence that identity verification systems create centralized data honeypots, arguing that mandatory online age verification could increase privacy risks and chill free speech. Law enforcement: The FBI’s involvement signals that the breach is being treated as a serious criminal matter, with the New Orleans field office now tasked with tracing the source of the leak.

What to Watch

Whether IDScan.net issues a public confirmation or notification of the breach, and what scope it acknowledges.
The FBI’s investigation progress — including possible identification of the sellers behind Nexus or the original intrusion point.
Political and legislative reactions, particularly around pending age verification laws in California and other states.